Child accounts

[Recipeasy]

Hi and thanks for any help in advance

I'm working on creating a free to use app that creates meal plans for children. To access the app, the user will need to create an account. Can anyone give any advice as to what I, legally, need to do or not do when collecting and storing children's data?

I've read through some information on the Information Commissioner's Office website but there's nothing clear cut that says "you must do this, you mustn't do that". What I need is an idiots guide to collecting children's data.

If there are any legal experts that can explain this really simply to an idiot like me that'd be much appreciated.

Thanks
Drew

 

[fisicx]

What data are you collecting?

If it’s just a first name and birth year there’s nothing that really identifies the child. If you then start collecting allergy info and dietary info then it starts to get very personal.

If it’s only stored on the app it becomes simpler. If you are passing it back to a server then you enter a whole complicated world of privacy and security.

 

[Recipeasy]

So they’ll have to register with us to use the service. The child or their guardian would need to import their email.

From there on in it would be first name and maybe just their age rather than d.o.b if that makes things less complicated.

Ideally we’d like to store their meal preferences and dietary requirements so that they don’t have to keep entering them every time they come to do a meal plan.

We may include the functionality of the child uploading a photo of themselves or an avatar onto their account further down the line - would that complicate things?

When it comes to storing the data, the service is not solely going to be accessed via an app - there will be a website also, so my guess is there will be the passing of data to a server involved.

Again, any advice would be much appreciated.

 

[IanSuth]

Our childrens' school try to use squid for all payments, that includes parents uploading money that children then use to pay form lunches via a fingerprint reader (i still pay the school the money direct as I hate squid's T&C's but that is by the by)

It is the parents who have the contract with squid

I would have thought it easier/safer to have parents sign up their children (or at least u16's) to the system than have children directly interacted with. I think you will also have to look at DBS check for people with access to the backend data, not sure if that is legally necessary but it is cheap and would be a useful think to have done if there is ever an issue