StepWise’s AI never learns who your students are.
Special-education records are some of the most sensitive data a centre holds. Here is where StepWise keeps them, who can see them, and exactly what the AI provider receives.
Why UAE hosting, and why names stay away from the AI.
Therapy records can be health data
Therapy notes, assessments and IEP goals can include a child’s health information, which UAE law treats as sensitive personal data.
Health data is expected to stay in the UAE
If your centre is licensed as a health facility, for example by DHA, DOH or MOHAP, UAE law generally requires that health information stay inside the UAE unless an approved exception applies.
Abu Dhabi’s health-sector security standard also expects cloud-hosted health data, including backups, to stay in the UAE.
So your records can stay in the country
StepWise gives each centre its own separate system and database, hosted in-country wherever a suitable data centre is available. With in-country hosting, your records stay in the country, which settles where the records themselves are kept.
And the AI is not told who anyone is
Before any AI step, StepWise replaces names, contact details, ID numbers and addresses with placeholders and keeps only the month and year of dates, so the AI provider is not told who anyone is.
Only text is sent, never photos, PDFs or files, and every AI request is logged with exactly what was sent.
Check AI drafting with your regulator. The AI provider processes the text it receives outside the UAE, and some health regulators restrict even de-identified health information from leaving the country, so health-licensed centres should check with their regulator before using AI drafting. If AI drafting is not right for your centre, it can be switched off.
Your licence decides the rest. Your own obligations depend on who licenses your centre, including DIFC or ADGM rules, and on your agreements with families, such as guardian consent and record retention. This is general information, not legal advice: confirm your obligations with your legal adviser.
What is stored where.
StepWise is built and run by Lite Software Solutions (FZE), LSS for short. Every centre gets its own isolated deployment: its own app, database, file store and secrets. No data is shared between centres.
| What | Where, and how it is handled |
|---|---|
| Your records | Students, plans, logged tries and reports live in your centre’s own database, inside its own deployment. |
| The region | Chosen for your centre: your region, and in-country wherever a suitable data centre is available, to meet your data requirements. With in-country hosting, your records stay in the country. Our team has hands-on expertise across the major clouds. |
| Documents | Your deployment’s private file store. Links to a document expire after 5 minutes. |
| Recordings | The audio is transcribed inside your centre’s own system. When AI is on, only the transcript, with names, contact details, ID numbers and addresses replaced, goes to the AI provider to propose the tries. Clips are deleted after 180 days; the tries stay. |
| Backups | Taken daily. |
| Text for AI steps | Sent to the AI provider, Anthropic, in the USA. Names, contact details, ID numbers and addresses are replaced first, and files are never sent. Nothing is sent at all if AI is switched off for your centre. |
Each role sees only its part.
| Role | Sees and does | Never sees |
|---|---|---|
| LSS super admin | Setup only: centre settings, accounts, the student list (names only), the goal pool, response sets, document types, the audit log and error reports. | Student records, documents, session logs, plans, or IEP and annual reports. |
| Centre admin | The dashboard, students, teams, parent logins and reports. | Other centres: each has its own deployment. |
| IEP coordinator | Student records, the IEP studio, approvals and reports. | Other centres. |
| Therapists & teachers | Today, claiming goals and logging sessions, for the students on their teams. | Students who are not on their teams. |
| Parents | Their own children: plan approval, the goals shared with them and home practice. | Other children, or progress on goals that were not shared with them. |
Locked down, by design.
- Hashed passwords, never stored as typed.
- Sign-in lockout after repeated failed attempts.
- Sessions that can be revoked.
- Document links that expire after 5 minutes.
- Private file storage.
- An audit log.
- Daily backups.
What the AI does, and what it receives.
- Documents are read by code, not AI: the text layer first, then OCR in English and Arabic.
- People decide. Goals are suggested only from your centre’s own pool, and your coordinator confirms every plan.
- Placeholders first. Names, contact details, ID numbers and addresses become placeholders inside your centre’s own system before any AI step, and dates keep only the month and year.
- Only text. Never photos, PDFs or files. For a recording, only the transcript of the speech is used.
- A final check refuses the call if a known name is still in the text.
- Names stay behind. The list that turns placeholders back into names is never sent to the AI provider.
- Every AI request is logged with exactly what was sent. For plans and annual summaries, a “Sent to AI” view shows it.
- The provider is Anthropic, through its Claude API, in the USA.
- Your choice: AI can be switched off for your centre.
What we don’t claim
This is pseudonymisation rather than full anonymity, because your centre can still link each result to the right child.
So we never call StepWise “fully anonymous”, and we never claim it makes a centre compliant. That depends on your licence and your agreements with families.
The services StepWise relies on.
| Provider | What for |
|---|---|
| Your cloud hosting provider | Hosting your deployment, in the region and country chosen for your centre; confirmed with you before go-live. |
| Anthropic (Claude API), USA | AI drafting steps, such as summaries, goal suggestions, the plan assistant and tries proposed from a recording’s transcript. It receives text with names, contact details, ID numbers and addresses replaced, never files. Not used if AI is switched off for your centre. |
| Expo | Delivering the phone app to iPhone and Android. |
| An email provider, confirmed before go-live | Sending invitations and notification emails. |
Official sources.
The laws and standards behind this page. For the federal texts, English translations are for reference and the Arabic originals are authoritative.
This is general information, not legal advice. Confirm your obligations with your legal adviser.
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- Federal Law No. 2 of 2019 on the Use of ICT in Health Fields
- Ministerial Resolution No. 51 of 2021: when health data may be stored or transferred outside the UAE
- Department of Health Abu Dhabi: ADHICS, version 2
- Department of Health Abu Dhabi: Responsible AI Standard (2025)
- Dubai Health Authority: Policy for Health Information Sharing (2024)
- Department of Health Abu Dhabi: ABA guidelines (2024)
- u.ae: Education for people with special needs
- DIFC Data Protection Law No. 5 of 2020
- ADGM Data Protection Regulations 2021
StepWise data privacy: common questions
Where is our centre’s data stored?
Can LSS staff see our students’ records?
Does the AI see children’s names?
Can we switch the AI off?
What happens to session recordings?
Ask us anything about your centre’s data.
We will show you where your records live, what each role sees, and exactly what the AI receives.