OVC Portal privacy notice

Orah Vocal Coaching is the controller for personal data used in the portal. Privacy questions can be sent to hello@orahvocalcoaching.com.

The portal may store account identity, email address, role, family account membership, child names, child dates of birth, age bands, enrolment type, emergency contacts, medical notes, adult student profile details, consent records, digital signature name, bookings, billing status, messages, attendance, progress summaries, private teaching notes, deletion requests, and audit logs.

Payment card details are handled by Stripe and are not stored directly in the OVC portal.

• To create and manage portal accounts.
• To manage child and adult student profiles.
• To schedule, deliver, and record vocal coaching sessions.
• To manage payment setup, invoices, subscriptions, and receipts.
• To communicate with parents, guardians, and adult students.
• To support safeguarding, consent, attendance, and progress records.
• To respond to data deletion requests and security events.

OVC uses different lawful bases for different purposes. Contract is used where processing is needed to provide coaching services and manage bookings or billing. Legal obligation is used where records must be kept or disclosed by law. Legitimate interests are used for proportionate administration, service safety, security, audit logs, and safeguarding-related operation.

Consent is used for optional choices such as media consent and for recording agreement to portal terms and privacy acknowledgement. Medical notes may include health information, which has stronger legal protection and should be collected only where relevant to safe lesson delivery.

Child profile data is used only for OVC services, safeguarding, communication with authorised parents or guardians, billing, attendance, and progress records.

Child photos or media use must not be enabled unless current media consent has been granted. Parents and guardians can update consent choices through the portal where available or by contacting OVC.

OVC uses service providers to operate the portal. These may include hosting, database, authentication, payment, and transactional email providers such as Vercel or equivalent hosting, PostgreSQL hosting, Clerk, Stripe, and Resend or an equivalent email provider.

OVC should confirm the final processor list, data processing terms, and any international transfer safeguards before using the portal with real student data.

OVC keeps personal data only for as long as needed for coaching, safeguarding, billing, legal, tax, audit, dispute, or legitimate operational purposes.

Depending on the data and lawful basis, you may have rights to be informed, access your data, correct inaccurate data, request deletion, restrict processing, object to processing, and receive portable data.

Some rights are not absolute. OVC may need to retain records for legal, safeguarding, billing, or dispute reasons.

The portal uses protected routes, role-based access, admin MFA, scoped child profile access, Stripe webhook verification, audit logs, and admin-only exports to reduce unauthorised access risk. Users should keep their sign-in details secure and report suspected account compromise promptly.

Please contact OVC first so the concern can be reviewed. You also have the right to contact the Information Commissioner's Office if you are concerned about how your personal data is handled.