Try the demo school
For heads

Every child's record, in one place, for good.

A markbook the whole school writes in and nobody can quietly rewrite. Sensitive records that cannot leak. Classes built with the rules you set. Parents who see exactly what you decide, and nothing more.

Book a 20 minute walkthrough Try the demo school
The access log on a phone, headed "Who has seen Cinnamon Bopplewick's information": Ms Marigold Fanshaw's own roster, share and profile views from today, then a parent evening print the day before, a second staff member, Mr Bartholomew Quibb, viewing the profile the day before that, and a parent opening a shared link two days earlier, each dated and timed to the minute.
Access log Demo data
app.usebhala.app /sharing
The access log on a wide screen, headed "Who has seen Cinnamon Bopplewick's information": eleven rows running from today's session back through a parent evening print, a second staff member (Mr Bartholomew Quibb) viewing the profile, a Wobblewood parent opening a shared link and the share itself being created four days earlier, each naming who did what and the date and time to the minute, above a panel offering the same summary on paper instead of a link.
Access log Demo school. Every pupil here is fictional.
Access log

Open any pupil. See who saw what, when.

Every view, entry, correction and share is written down as it happens, and you can open a pupil and read their full history. Corrections keep the original beside them. Nobody, including us, can edit or remove an entry.

The access log on a phone, headed "Who has seen Cinnamon Bopplewick's information": Ms Marigold Fanshaw's own roster, share and profile views from today, then a parent evening print the day before, a second staff member, Mr Bartholomew Quibb, viewing the profile the day before that, and a parent opening a shared link two days earlier, each dated and timed to the minute.
Access log Demo data
Sensitive records

Sensitive records that cannot leak.

Medical, pastoral and legal notes are encrypted separately with their own key, readable only by school admins and academic support, and structurally excluded from every share, print, report and export. A class teacher cannot open one.

In plain English: a parent link, a printed page or a report draft physically cannot include a sensitive record. This is enforced in the database, not by a setting a tired teacher could miss. POPIA sections 19 and 26 are the reason.

Sensitive record

Readable by
School admins, academic support
Never readable by
A class teacher
Excluded from
Shares, prints, reports, exports
Encrypted
AES-256-GCM, separate key
Retention
Medical 5 years, other 7
House wording

Reports in the school's voice, not ours.

You set the phrase bank: how your school says "excellent", how it handles a difficult term, which words never appear. Every draft obeys it.

Phrase bank, your school's own

Above expectation
"shows real command of"
Needs support
"the next step is"
Never used
weak, poor, struggling, behind
Sign-off
Your house style
Class Builder

Next year's classes, built with your rules.

Keep-aparts and language balance are honoured as hard rules. Friendships and a fair spread of ability are balanced as soft ones. Bhala shows you which pupil is locked and why.

Class Builder on a phone after a run: pills confirming everyone placed 50 of 50, keep-apart rules held, the language split within 0 per class and everyone has a chosen friend, a rebuild the classes button, then the proposed class 3A as a column of named pupil cards, each carrying a language code and a pin button, with the next class beginning at the right edge.
Class Builder Demo data
Sharing

Parents see by PIN. You can revoke instantly.

No parent logins to manage. You tick which of six details a family sees, from a fixed safe list, and at least one must be ticked. They get a PIN for one pupil, the link expires after fourteen days, and you can revoke it in one tap. Logged.

Share with a family

You tick
Any of six details, at least one
Never sees
Other pupils, staff notes, sensitive
Link expires
14 days
PIN
6 digits, unique to one pupil
Revoke
One tap, logged
Access grants

Access by class, granted and revoked by you.

A class teacher sees her own class without being granted anything. Anyone else is granted one named class at a time, and it lasts until you click to revoke it.

Who sees what

Class teacher
Her own class, automatically
Anyone else
A named class, until you revoke it
Academic support
Granted classes, plus sensitive records
School admin
The whole school, including sensitive records
Retention

Retention that can only be tightened.

Medical records are kept for five years after a pupil leaves and other records for seven. Academic history is kept permanently and cannot be edited. A head can shorten either window. Nobody can lengthen one or switch it off.

POPIA asks that records are not kept longer than needed. Bhala makes the safe direction the only direction.

Retention defaults

Medical records
5 years after leaving
Other records
7 years after leaving
Academic history
Kept permanently
Direction
Shorten only
Who can loosen it
Nobody

Twenty minutes, your questions.

A walkthrough with a person, on your school's terms. Bring the head of department and whoever holds the POPIA file.

Book a 20 minute walkthrough

Contact

Ask us anything, or book the walkthrough.

Tell us who you are and what you need to know. We answer in a day, in working hours, from a real person. If you would rather write, the address is hello@usebhala.app.

Fields marked are required.