1. Who we are, and who is responsible for what
Hodari SIMS Plus is a school information management platform operated by Hodari Technologies Ltd. (“Hodari”, “we”, “us”), a company registered in Ghana. It is delivered as a web application at simsplus.io and as the Hodari SIMS Plus mobile app for Android and iOS.
Who you should contact depends on who is responsible for the record:
- Your school is the data controller for the records it keeps in SIMS Plus: its students, their guardians, its staff and its finances. The school decides what to record, who at the school may see it, and how long to keep it. We hold that data on the school’s instructions and do not decide those questions.
- Hodari is the data processor for that school data, and the controller only for our own direct relationships: the account we issue you, the support conversations you have with us, the agreements a school signs with us, and enquiries sent through this website.
So a request about a child’s record goes to the school first, because the school decides it. We will still help, and if a request reaches us that should go to the school, we will tell you so.
We process personal data in accordance with the Ghana Data Protection Act, 2012 (Act 843), and with the data protection law of each country where a school using SIMS Plus operates.
2. The information we handle
- Account information. Your name, email address, phone number, role and the school you belong to. Accounts in SIMS Plus are issued by your school: to staff, to parents and guardians, and, where the school uses the student portal, to its pupils from Basic 1 up. There is no public sign-up, and the mobile app has no registration screen. Families who sign up for Hodari Learn themselves at hodarilearn.com are covered by that site’s own privacy notice.
- School records. Entered by authorised staff: student profiles and enrolment, guardians and their contact details, attendance, marks and reports, behaviour and welfare notes, staff records and employment details, library loans, transport assignments, and fees, invoices and payments. In preschool settings this extends to daily logs, observations and photographs of children.
- Health and welfare details, where a school records them. Allergies, medical notes and incident reports are sensitive personal data. They are entered at the school’s discretion, shown only to staff whose role requires them, and never used for anything but the care of that child.
- Payment details. Mobile Money and bank transfer references, amounts and timestamps. Card numbers are never entered into or stored by SIMS Plus: online payments are completed on the payment provider’s own hosted page, and we receive only the outcome and a reference.
- Technical and diagnostic data. IP address, browser or device type, app version, and error reports. We use this to keep the service running and to investigate faults.
3. What the mobile app collects from your device
The app may ask for the permissions below. Each is used only for the purpose given, and you can refuse any of them and still use the app.
- Location (staff clock-in and clock-out only). When a member of staff clocks in or out, the app records a single position fix (latitude, longitude and the accuracy of that fix) so the school can confirm the punch was made on site. The app explains this and asks you in-app before the system permission prompt appears. It is collected only in the foreground, only at that moment: there is no background location, no journey history and no tracking between punches. If you refuse, you can still clock in, and the record notes that no location was given. Only staff who clock in are asked for location.
- Camera and photo library. Used when you take or choose a passport photograph for a student or staff record, or capture a photo for a preschool observation. The app opens the camera only when you tap a control that says so, and uploads only the image you confirm.
- Notifications. If you allow them, your device receives a token from Google or Apple that lets us send you alerts about your own school, such as a fee reminder, a report card or an absence. The token identifies the installation, not you personally, and is deleted when you sign out.
- Face ID, Touch ID and fingerprint unlock. Optional, and the match happens entirely on your device. Your biometrics are held by the operating system and are never sent to us or stored by us. The app only asks the operating system whether the person holding the phone is you.
- Offline copy on the device. To work where the network does not, the app stores a copy of the records you are working with, and any changes you make while offline, in the app’s private storage. Signing out clears it.
4. How we use information
- To provide and operate the platform for your school
- To send the messages a school asks us to send (fee notices, report cards, attendance alerts) by SMS, email or push notification
- To process fee payments and produce receipts and statements
- To authenticate you, keep your account secure, and maintain audit trails of who changed what
- To provide support when you or your school contacts us
- To keep the service reliable: monitoring, diagnosing faults, and planning capacity
- To meet our legal obligations in Ghana and in the countries where our schools operate
5. Children's and students' data
SIMS Plus holds records about children, including children under 13. It is a tool for schools, and every account is issued by a school. Most are issued to staff and to parents and guardians. Where a school turns on the student portal, its pupils from Basic 1 up also get an account of their own, which signs in with a student ID and whose first code is sent to the pupil’s primary guardian. The mobile app is not directed to children and is not distributed as a children’s app.
Records about a child are entered by the school, on the school’s lawful basis and with the consent the school obtains from the family. A pupil with an account sees only their own record, and what they do there, such as work they hand in, quiz answers and Hodari Learn practice, becomes part of the school’s record about them, held on the school’s instructions like the rest. We never use a child’s data for advertising, profiling for marketing, or any purpose of our own.
Where a school records photographs of children, only the child’s own teachers and family at that school can see them.
6. How schools are kept apart
Every school on the platform is isolated from every other at the database level using PostgreSQL Row-Level Security, so a query made on behalf of one school cannot return another school’s rows even if the application above it were at fault. Within a school, access is further limited by role: a teacher sees the classes they are assigned to, the bursary sees fees, a parent sees only their own children, and a pupil sees only their own record. Access to records is recorded in an audit trail.
7. Who else processes data
We use a small number of service providers to run the platform. Each receives only what it needs to perform its function, is bound by contract to protect it, and may not use it for its own purposes.
- Amazon Web Services: hosting, databases and file storage
- Paystack and ExpressPay: payment processing. Card details are entered on their pages and never reach us
- Arkesel: SMS delivery
- Resend: transactional email
- Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering push notifications to your device
- Sentry: error monitoring, where a school has it enabled
- OpenAI, Anthropic and Google: the AI drafting features, only where a school uses them. A request carries what the draft needs, such as a pupil’s first name and the results a report remark is about, and never a surname, student ID, contact details or health records
- Microsoft (Azure Speech): read-aloud narration of lesson text in Hodari Learn. It receives the lesson text only, and no personal data
We may also disclose data where the law requires it, or to establish or defend a legal claim. We will tell the affected school unless we are prohibited from doing so.
8. What we never do
- We do not sell or rent personal data
- We do not show advertising in SIMS Plus, and we share no data with advertising networks or data brokers
- We carry no third-party analytics or advertising SDKs in the mobile app, and we do not track you across other apps or websites
- We do not use school data to train machine-learning models. Where a school uses an AI drafting feature, the text is generated for that request and returned for a member of staff to edit and approve, and the model is not trained on it
- We do not make automated decisions that affect a person
9. Security
- TLS 1.2 or better for all data in transit
- AES-256 encryption at rest, for both the database and files
- Argon2id password hashing
- Optional multi-factor authentication, rate-limited sign-in, and an automatic 30-minute account lockout after five failed sign-in attempts
- Role-based access control and an audit trail of changes to records
- Daily automated backups, retained for 30 days
- Regular security testing, including deliberate attempts at cross-school access
If a breach affects your data, we will notify the affected school without undue delay, and the relevant data protection authority where the law requires it.
10. Keeping and deleting data
School records are kept for as long as the school’s subscription is active, because a school needs a pupil’s history for years after they leave. Some records, financial and academic ones in particular, must be retained to meet legal and audit obligations even after a request to delete them.
When a subscription ends, the school’s data is kept for 90 days so it can be exported or the account reinstated, and is then permanently deleted. Backups roll off within a further 30 days.
Signed agreements are kept as contractual evidence. When a school signs an agreement with us, such as a subscription agreement, a data processing agreement or a settlement mandate, we keep the sealed document and its signing record after the subscription ends, for as long as either party may need to rely on it. The record names each person who signed and in what capacity, shows the email address or phone number their code went to only in part (masked), and holds the IP address they signed from and when. Anyone holding a sealed copy can check it is genuine with its verification code; that check shows none of the document’s content.
Deleting your account. Because your school issues and owns your account, ask your school administrator to remove it. They can do this immediately, and it ends your access at once. If you would rather not go through your school, or your school is no longer reachable, write to info@simsplus.io and we will delete it and confirm in writing. Deleting an account removes your ability to sign in and your personal profile; records you created on the school’s behalf remain the school’s, for the reasons above.
11. Your rights
Under the data protection law that applies to you, including Ghana’s Data Protection Act, you have the right to:
- Know what personal data is held about you, and obtain a copy
- Have inaccurate data corrected
- Ask for data to be deleted, subject to the retention obligations above
- Object to processing, or ask that it be restricted
- Withdraw a consent you previously gave, at any time
- Receive an export of your school’s data
- Complain to your national data protection authority (in Ghana, the Data Protection Commission)
Exercise any of these through your school, or write to info@simsplus.io. We respond within 30 days, and we will not charge you for a first request.
12. Where data is held
Our infrastructure is hosted with Amazon Web Services, and data may be stored and processed outside your country, including in the United States and the European Union. Where data leaves your country we rely on contractual safeguards with our providers that hold them to a standard of protection equivalent to that required by the law that applies, such as Ghana’s Act 843.
13. Changes to this policy
When our practices change we will update this page and the date at the top of it. If a change materially affects how personal data is handled, we will also tell the schools using SIMS Plus directly.
14. Contact us
For any privacy question, or to exercise a right above, contact our Data Protection Officer at info@simsplus.io, or write to Hodari Technologies Ltd., R224 Okpoti Street, Teshie, Accra, Ghana. If you are a parent or a member of staff at a school using SIMS Plus, your school’s administrator can usually deal with a request faster.