BFIS Portal Privacy Notice

Who this covers

This notice applies to the BFIS Portal Android application published by Bright Future International School (“BFIS”, “the school”, “we”) and to the school portal service the app connects to at api.bfis.qa.

It covers two groups of people: parents and guardians who sign in to follow their children’s schooling, and students who sign in to their own records. Where this notice says “your child’s information”, it means information about a student that a linked parent account is permitted to see.

The app is a window onto records the school already keeps as part of running a school. It does not create a separate collection of data about you, and it is not a commercial product — there is no advertising in it and nothing in it is sold.

How accounts are created

You cannot register in the app. There is no sign-up screen. Accounts are created by the school for families already enrolled, using information the school holds from admission and registration.

Parents sign in with their Qatar ID (QID) number and a password. Students sign in with the email address registered in the school’s system and a password. Passwords are always sent over an encrypted connection. A password you set or change is stored as a one-way cryptographic hash, so it cannot be read back by anyone, including school staff. Older passwords carried over from the school’s earlier system are converted to this form the next time the account signs in. School staff have no access to passwords and will never ask for yours. A forgotten password is reset, never recovered.

Information the app handles

Everything below is information the school already holds in its student management system. The app displays it to the people entitled to see it and, in a few places, lets you send something back.

Fee information is displayed only. The app does not take payments, has no payment screen, and never handles card or bank details.

Health and other sensitive records

The app shows health information about students — clinic visits, recorded medical conditions and allergies, medication, physical measurements, vision and vaccination status. Most privacy laws treat this as a special category of personal data deserving stronger protection, and we treat it that way.

This information is held because the school has a duty of care: staff must know about an allergy or a condition before an emergency, not after one. It is shown in the app only to the student concerned and to a parent or guardian linked to that student. It is never used for any purpose beyond the child’s care and safety at school, and it is never shared outside the school other than as described in section 9.

Discipline records are treated with the same restriction.

How information is used

• To confirm who you are when you sign in, and to show you only the records you are entitled to see.
• To display your child’s attendance, academic progress, timetable, fees and school notices.
• To deliver what you send — a homework submission, a leave request, a message to a teacher, a complaint.
• To email you a confirmation when you submit a leave request.
• To call your child out at dismissal when you tap Pick up, after checking that you are at the school.
• To keep the service working and secure: detecting failed sign-in attempts, diagnosing faults, preventing misuse.

That is the complete list. Information in the app is not used to build a profile of you, to target anything at you, or for any purpose unrelated to your child’s schooling.

What the app never does

These are not undertakings about our intentions — they are descriptions of what the software contains:

• No advertising. There is no ad network in the app and no ad is ever shown.
• No selling or renting of personal information, to anyone, in any circumstance.
• No analytics or tracking SDKs. The app contains no Google Analytics, Firebase, Crashlytics, Meta SDK or any comparable library.
• No advertising or device identifiers. The app does not read your advertising ID, IMEI, serial number or Android ID.
• No location tracking. The app reads your location only at the moment you tap Pick up, to confirm you are at the school gate, and never in the background. The location is not stored. See “Device permissions” below.
• No access to your contacts, calendar or microphone. It does not hold the permissions that would make any of these possible.
• No browsing of your photo library. The app cannot look through your photos. When you choose one to attach, Android hands over only that single photo.
• No camera use except when you ask for it. The camera opens only when you tap “Take a photo” to attach one, and nothing is captured in the background. See “Device permissions” below.
• No cross-app or cross-site tracking of any kind.

Device permissions

This is the complete list of Android permissions the app declares:

On iPhone the app asks for the same two things — the camera, and location “While Using the App” — at the same moments, and for nothing else.

Your location. We ask for location only the first time you tap Pick up to call your child out at dismissal, never on startup, and only for parents signed in with their QID. When you tap, the app takes a single reading of your phone’s position and sends it with the request. The school’s server checks that you are within a short distance of the school gate and then discards the reading — it is not saved, logged or shared, and no record of where you were is kept. The app never reads your location in the background, while you are using other parts of the app, or when it is closed. If you refuse, everything else in the app works as before; only Pick up asks you to use your card at the gate instead.

The camera. We ask for the camera only at the moment you tap “Take a photo”, never on startup. If you refuse, the rest of the app is unaffected and you can still attach anything already on your device. If you refuse permanently, Android stops showing the request and the app will offer to take you to Settings — that is the only place the decision can be reversed. Nothing is ever captured without you seeing the camera on screen.

Where a photo you take goes. Into a private folder belonging to the app, not into your gallery or camera roll. It is uploaded to the school when you submit the form, then deleted from your device. If you change your mind before submitting, it is removed automatically.

Files and photos you already have. Android’s own file picker or photo picker opens and hands the app the single item you chose. The app cannot browse your storage or your photo library, and is never granted access to anything else. This is why the app requests no storage or photo-library permission at all.

Stored on your device

While you are signed in, the app keeps a small amount of information on your phone so it does not have to ask you to sign in repeatedly:

• Your sign-in token, which expires 24 hours after you sign in
• Your role, internal user ID, display name and QID
• The child currently selected, so the app can show the right context immediately when reopened

Signing out erases all of it. Uninstalling the app removes everything. None of it is readable by other apps.

Because the sign-in token lasts 24 hours, sign out rather than simply closing the app if you are using a shared or borrowed device.

Who else sees information

We do not sell or rent personal information. It is disclosed only in these situations:

Within the school

Teachers, administrative staff, the clinic and finance staff access the records their role requires, under the school’s internal access rules.

Service providers

Legal obligation

Where the law of the State of Qatar, a court, or a competent regulatory or educational authority requires disclosure, we comply — and limit what we disclose to what is required.

These providers process information on the school’s instructions only. They are not permitted to use it for their own purposes.

How it is protected

• All traffic between the app and the server is encrypted with TLS. The app refuses unencrypted connections outright.
• Passwords you set or change are stored only as one-way hashes; older passwords from the earlier system are converted at the next sign-in. School staff have no access to passwords.
• Every request is checked against the signed-in account: a parent can reach only their own linked children’s records, and a student only their own.
• The database is not reachable from the internet. It accepts connections only from the school’s own server.
• Sign-in tokens expire automatically after 24 hours.

Server logs record technical detail needed to keep the service running and to investigate problems — including the time of requests, error information, and the email address a notification was sent to. They are not used to build any profile of you.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify affected families and the relevant authorities as the law requires.

How long it is kept

Student records are educational records. The school keeps them for as long as the student is enrolled and afterwards for the period required by Qatari education regulations and the school’s own records policy — academic transcripts, for example, are kept long-term because former students need them.

A Pick up call-out is kept in the school’s dismissal log, alongside the records made when a parent punches their card at the gate: the child, the time and the phone’s IP address. It does not include your location.

The app itself stores nothing long-term. What it holds on your device is described in section 8 and is erased when you sign out.

Students and children

Most students at BFIS are children, and this app exists to show information about them to the adults responsible for them. We take that seriously.

• The app is not directed at children as a consumer product. It contains no advertising, no in-app purchases, no social features, no public profiles and no way to contact anyone outside the school.
• Student accounts are created by the school for enrolled students only, with the knowledge of the enrolling parent or guardian.
• A student account can see only that student’s own records.
• Information about a child is never used for marketing or profiling, and is never disclosed to a third party for their own purposes.

There is no minimum age for the student section. A student signs in with the family’s email address registered with the school and a separate student password, so a child’s access comes through the family’s own account and the enrolling parent or guardian can always see the same records.

Your rights

Seeing your information needs no request. Everything the app handles about you or your child — attendance, homework, results, fees, health and conduct records, messages — is available to you at any time in the app and on the school portal.

As the parent or guardian of an enrolled student, or as a student, you may also ask us to:

• Correct anything inaccurate — a misspelled name, a wrong date of birth, an out-of-date phone number or medical detail.
• Explain how a particular record was produced or why it is held.
• Restrict or object to a particular use of information, where the law gives you that right.
• Delete information, subject to the limits in section 14.

Write to the contact in section 16. There is no charge. We may need to verify your identity and your relationship to the student before changing anything — a safeguard that protects your child.

Deleting your data

The app has no sign-up, so it has no self-service account deletion. Accounts are created and closed by the school.

To request deletion

Email [email protected] from your registered address, or write to the school office, stating the student’s name and what you want removed.

What happens

• Your portal access — the login account itself — is closed on request, at any time. This stops all access through the app.
• Optional information you supplied, such as authorised pickup contacts or a phone number beyond what enrolment requires, is deleted on request.
• Core educational records — attendance, assessment results, fee history, health and safeguarding records — cannot be deleted on request while a student is enrolled, and afterwards only when the retention period set by Qatari education regulation has elapsed. A school is legally required to keep these. We will tell you which category applies to your request and when the record becomes eligible for deletion.

When an account is closed, the app on your device stops working at next sign-in, and signing out clears everything stored locally.

Changes to this notice

If this notice changes we update the effective date at the top and publish the new version at this address. If a change materially affects how your information is used, we will tell families directly through the app or by email before it takes effect — we will not make a significant change quietly.

Contact us

For any question about this notice, or to exercise any right described in it:

This notice is governed by the law of the State of Qatar, including Law No. 13 of 2016 on the Protection of Personal Data Privacy. If you believe your information has been mishandled, you may raise it with the school first and, if unresolved, with the competent Qatari authority.