Part 6. Privacy and safety in practice
6.1 What you can see
Why one member of staff sees a page that another does not, and what to do when something you expect is missing.
Written forFront officeTeacherRegistrarPrincipal and executiveIT
The idea
Kestrel shows you what your job needs and nothing more. Your role decides what you can read and do, and the school's administrators can change what each role includes. The same rule applies to everyone, including the principal.
You will notice it in small ways. A tab on a student's page may be missing. A section may say that an entry exists and keep what it says. A button may not be there. In each case the screen leaves out what your role does not reach.
Three levels of care
Each field in Kestrel is kept at one of three levels. The floor is "internal", which any staff member with the right role reads. "Sensitive" fields, such as who pays a student's fees, are for the roles that need them. "Restricted" fields, such as a parenting order, are for a very small group. Your role includes capabilities, and each capability reaches up to one of those levels.
| Level | Example | Who usually reads it |
|---|---|---|
| Internal | A student's name, year level and home group | Most staff |
| Sensitive | Authorised contacts, who pays fees | Office, registrar and business roles |
| Restricted | Parenting orders, exit reasons, a protected address | The principal and executive |
Separate kinds of record
Medical, wellbeing and child-protection records are kept apart from each other and from the student record. They are not levels on one scale. A nurse reads the medical record and has no business in a counselling note, and neither has any business in a child-protection concern. The roles describe it plainly:
- Teacher: "Reads the students in front of them, and reaches nothing restricted."
- Head of house or year: "Pastoral oversight of a cohort, and still reaches nothing restricted."
- Wellbeing: "Reaches the pastoral tier: cases, plans, alerts and the NCCD register, or the SEND register in England." It does not include counselling notes or child-protection concerns.
- Counsellor: reads and writes each student's counselling notes, which no other shipped role reaches.
- Nurse: "Reaches the medical tier", which is kept apart from the pastoral record.
- Child safety officer: records the child-protection concerns, and reaches nothing of the pastoral or medical record.
- Principal and executive: "Accountable for the school", and the one staff role that reaches restricted person facts, the protected mark and the audit trail.
- Privacy officer: keeps the privacy register, which no other shipped role reaches.
When something is missing
A missing tab or button means your role does not include it. Ask your administrator to read your role on the roles screen. If you are signed in but the school has given your address no access at all, you see "No access at" followed by the school's name, with the words "The school's office can give it access." and the button "Sign out and use another account".
- Check that you are signed in with the address the school has for you.
- Ask the person who runs Kestrel at your school which role you hold.
- If the role is right and the page is still missing, the capability belongs to another role. Ask the principal whether you should have it.
No access
/no-accessWhat a signed-in account sees when the school has not given it access.
Roles
/app/settings/rolesWhere an administrator reads what each role includes.
Training notes
- Teach the tiers with the three examples in the table above.
- Make clear that a missing section is not a fault. The role may not include it.
- Remind staff that curiosity about a record is visible in the audit trail.