Every child's record, in one place, for good.
A markbook the whole school writes in and nobody can quietly rewrite. Sensitive records that cannot leak. Classes built with the rules you set. Parents who see exactly what you decide, and nothing more.
Open any pupil. See who saw what, when.
Every view, entry, correction and share is written down as it happens, and you can open a pupil and read their full history. Corrections keep the original beside them. Nobody, including us, can edit or remove an entry.
Sensitive records that cannot leak.
Medical, pastoral and legal notes are encrypted separately with their own key, readable only by school admins and academic support, and structurally excluded from every share, print, report and export. A class teacher cannot open one.
In plain English: a parent link, a printed page or a report draft physically cannot include a sensitive record. This is enforced in the database, not by a setting a tired teacher could miss. POPIA sections 19 and 26 are the reason.
Sensitive record
- Readable by
- School admins, academic support
- Never readable by
- A class teacher
- Excluded from
- Shares, prints, reports, exports
- Encrypted
- AES-256-GCM, separate key
- Retention
- Medical 5 years, other 7
Reports in the school's voice, not ours.
You set the phrase bank: how your school says "excellent", how it handles a difficult term, which words never appear. Every draft obeys it.
Phrase bank, your school's own
- Above expectation
- "shows real command of"
- Needs support
- "the next step is"
- Never used
- weak, poor, struggling, behind
- Sign-off
- Your house style
Next year's classes, built with your rules.
Keep-aparts and language balance are honoured as hard rules. Friendships and a fair spread of ability are balanced as soft ones. Bhala shows you which pupil is locked and why.
Parents see by PIN. You can revoke instantly.
No parent logins to manage. You tick which of six details a family sees, from a fixed safe list, and at least one must be ticked. They get a PIN for one pupil, the link expires after fourteen days, and you can revoke it in one tap. Logged.
Share with a family
- You tick
- Any of six details, at least one
- Never sees
- Other pupils, staff notes, sensitive
- Link expires
- 14 days
- PIN
- 6 digits, unique to one pupil
- Revoke
- One tap, logged
Access by class, granted and revoked by you.
A class teacher sees her own class without being granted anything. Anyone else is granted one named class at a time, and it lasts until you click to revoke it.
Who sees what
- Class teacher
- Her own class, automatically
- Anyone else
- A named class, until you revoke it
- Academic support
- Granted classes, plus sensitive records
- School admin
- The whole school, including sensitive records
Retention that can only be tightened.
Medical records are kept for five years after a pupil leaves and other records for seven. Academic history is kept permanently and cannot be edited. A head can shorten either window. Nobody can lengthen one or switch it off.
POPIA asks that records are not kept longer than needed. Bhala makes the safe direction the only direction.
Retention defaults
- Medical records
- 5 years after leaving
- Other records
- 7 years after leaving
- Academic history
- Kept permanently
- Direction
- Shorten only
- Who can loosen it
- Nobody
Twenty minutes, your questions.
A walkthrough with a person, on your school's terms. Bring the head of department and whoever holds the POPIA file.
Book a 20 minute walkthroughContact
Ask us anything, or book the walkthrough.
Tell us who you are and what you need to know. We answer in a day, in working hours, from a real person. If you would rather write, the address is [email protected].