Legal · KidsPass

KidsPass Privacy Policy

Last updated: September 29, 2026

KidsPass is the parent app for KidsTrack, the attendance and records system used by schools, daycares, and other childcare institutions (each an "Institution"). KidsPass is operated by IRI Technologies Ltd. ("IRI Technologies", "we", "us", "our"), Kingston, Jamaica.

This policy explains what information KidsPass collects about you and your child, why, who can see it, how long it is kept, and the choices and rights you have. It applies to the KidsPass mobile app and to the KidsTrack services that support it. Our general privacy policy covers our other products.

1. Who Is Responsible for Your Data

Your child's Institution decides what records it keeps about the children in its care, such as attendance, incidents, and required documents. IRI Technologies provides the KidsTrack platform and processes those records on the Institution's behalf.

IRI Technologies is responsible for your KidsPass account itself (your sign-in details, devices, and app settings) and for running the platform securely. For questions about a specific record your Institution holds, you can contact the Institution directly or contact us and we will help.

2. Information We Collect

About you (the parent or guardian)

• Your name, mobile phone number, and email address, used to create your account and sign you in.
• Details your Institution records about you or that you provide, such as your relationship to the child, home address, and, where the Institution requests them, occupation, employer, and work contact details.
• Records of your consent choices and when you acknowledged our privacy notice.
• A push-notification token for each device you sign in on, and the device platform (Android or iOS).

About your child

• Profile: name, date of birth, gender, class, and a profile photo.
• Attendance: the time of each drop-off and pick-up, who handed the child over or collected them, how it was recorded (QR scan or manual entry by staff), and absences you report.
• Pick-up and emergency contacts: names, phone numbers, relationship, and (optionally) photos of people you authorise to collect your child, and the emergency contacts you add.
• Incidents: reports your Institution logs, such as minor injuries or behaviour notes.
• Medical information (only with your separate consent): allergies, conditions, medications, dietary restrictions, blood type, doctor's details, and emergency notes.
• Documents (only with your separate consent): files such as immunisation records, birth certificates, or ID documents that you or the Institution upload.
• Billing: invoices and fees the Institution issues to you. KidsPass does not collect or store card or bank details from parents.

Pick-up codes

KidsPass shows a QR code for each child each day: one code for drop-off and a separate code for pick-up. Each code works once, for that child only, on that day. If you share a code with someone else so they can collect your child, the Institution's register will show that the pick-up used a shared code.

What we do not collect

• We do not collect your location.
• We do not use your camera, contacts, or microphone.
• We do not use advertising identifiers, and KidsPass contains no ads or third-party tracking.

3. How We Use Information

• To sign you in securely and link you to your child's Institution.
• To record drop-offs and pick-ups and confirm that the person collecting a child is authorised.
• To send you alerts, such as drop-off and pick-up confirmations, incident reports, announcements, and invoices.
• To let you view and keep your child's information up to date (profile, contacts, medical details, documents).
• To let the Institution care for your child safely, including in an emergency.
• To keep the service secure, prevent misuse, and keep an audit trail of who accessed sensitive records.

We do not sell personal information, we do not use it for advertising, and we do not use your child's information to build profiles for any purpose other than providing the service to you and your Institution.

4. Your Consent Choices

When you first use KidsPass, you choose what you are comfortable sharing for each child. You can change these choices at any time in Settings:

If you withdraw medical consent, your child's medical profile is deleted immediately, not just hidden. We keep only a record that consent was withdrawn, and the Institution is notified so it can update its own arrangements.

5. Who Can See Your Information

• Your child's Institution: authorised staff see the information they need to care for your child. Medical information is limited to Institution administrators, and every time it is viewed, the access is logged.
• Other parents or guardians linked to the same child can see that child's records.
• People you share a pick-up code with see only the code and your child's name.
• IRI Technologies staff access data only where needed to operate, support, or secure the service.
• Authorities, only where required by law, or where necessary to protect a child's safety.

We never share your information with other Institutions, other parents who are not linked to your child, or marketers.

6. Service Providers

We use a small number of providers to run KidsPass. They process data only on our instructions and are not permitted to use it for their own purposes.

These providers may store data on servers outside Jamaica. Where they do, we rely on their contractual commitments to protect it to a standard at least equivalent to this policy.

7. How Long We Keep Information

• Attendance records (drop-off and pick-up times) are kept for 7 years, so that Institutions can respond to safeguarding or liability questions. If a child's record is erased, the attendance entries remain but are no longer linked to the child's name.
• Other child records are kept while your child is enrolled with the Institution, plus 1 year.
• Deleted documents can be recovered for 90 days, then are permanently removed.
• Sign-in codes expire within minutes and are stored only in a scrambled (hashed) form.
• Pick-up codes are valid for one day only.
• Consent and audit records are kept for as long as the records they relate to, so we can show how data was handled.

8. Deleting Your Account and Data

You can delete your KidsPass account and personal data at any time, even if you no longer have the app installed:

• In the app: go to Settings → Delete account. We email you a code to confirm, and the account is deleted immediately.
• On the web: use our account deletion page, which works the same way, with your phone number and email.
• By email: if you can no longer access your email, write to info@cmit.com.jm with the phone number you sign in with. We will verify your identity and complete the request within 30 days.

What deleting your account removes

• Your name, phone number, and email address.
• Your link to your children, and the details the Institution held about you as their parent, such as address, occupation, employer, and TRN.
• Your devices, notification history, pick-up codes, and privacy notice acknowledgements.
• Everything KidsPass stored on your phone, if you delete from within the app.

What is kept, and why

• Your child's record belongs to their Institution and is not deleted. The Institution is told that you deleted your account so it can review who may collect your child.
• Attendance register entries, including the name recorded as handing over or collecting the child, are kept for 7 years for safeguarding and liability purposes.
• Invoices and billing records are kept by the Institution for as long as the law requires.
• Records of consent you gave for your child are kept as evidence of the basis on which the child's record is held.
• A log entry recording that your account was deleted.

These kept records are no longer linked to a usable account, and your name, phone number, and email are removed from your account itself.

Erasing a child's record

To erase a child's record, ask the child's Institution, or contact us. The child's name, date of birth, and other identifying details are scrubbed 90 days after the request (the window lets an Institution reverse a mistaken request). Attendance records are then kept without the child's identifying details, as described in section 7.

9. Your Rights

Under Jamaica's Data Protection Act, 2020, and similar laws elsewhere, you have the right to:

• Access the information held about you and your child. You can request a full export of your child's record.
• Correct inaccurate information. Many details can be updated directly in the app.
• Withdraw consent for optional categories at any time in Settings.
• Request deletion, as described in section 8.
• Object to or restrict certain processing.
• Complain to the Office of the Information Commissioner (Jamaica) if you believe your data has been mishandled.

To exercise any of these rights, contact us using the details below. We will respond within 30 days.

10. Security

• All data sent between the app and our servers is encrypted in transit (HTTPS).
• Medical information is additionally encrypted at rest using AES-256-GCM, and every access by staff is logged.
• Documents are stored privately and can only be opened through short-lived, signed links.
• Pick-up codes are cryptographically signed, single-use, and tied to one child and one day, so they cannot be forged or reused.
• Sign-in uses one-time codes rather than passwords, and you can add a PIN lock to the app on your device.
• Sensitive actions, such as consent changes, erasure requests, and medical record access, are recorded in an audit log.

No system is completely secure. If we become aware of a breach that affects your information, we will notify you and the relevant authorities as required by law.

11. Children's Information

KidsPass is intended for use by parents and guardians aged 18 or older. It is not designed for use by children, and children cannot create accounts.

Information about children is provided by their parents, guardians, and Institutions, and is used only to provide childcare attendance, safety, and communication services. We never use children's information for advertising, marketing, or profiling, and we never sell it.

12. Device Permissions

• Notifications: to alert you to drop-offs, pick-ups, incidents, and announcements. You can turn these off in your phone's settings or in the app.
• Files and photos: only when you choose to upload a document or photo. KidsPass opens your phone's standard file picker and accesses only the files you select.
• Internet access: to sync with your Institution. Today's pick-up codes are saved on your device so they still display without a connection.

13. Changes to This Policy

We may update this policy as KidsPass changes or as the law requires. The "Last updated" date above shows when it last changed. If we make significant changes, we will let you know in the app and ask you to review the updated notice before continuing.

14. Contact Us