Online Safety and Acceptable Use

1. Purpose

Much of the harm our learners face happens online: exploitation, sextortion, bullying, extremist and misogynist content, and the pull of apps built to keep them scrolling. This policy sets out how we protect learners while they are with us, how we teach them to protect themselves, how we respond when something goes wrong, and how adults use technology safely.

2. Scope

This policy applies to all staff, supply staff, counsellors, coaches, volunteers, students, SWMC members, visitors and learners. It covers Care Cove devices, networks and systems (including Care Cove Connect) wherever they are used, and online behaviour outside the provision that affects a learner's safety or wellbeing.

3. Law and guidance

• Keeping Children Safe in Education 2026 (KCSIE): online safety under four areas of risk (content, contact, conduct and commerce), with generative AI now named as a risk; nude and semi-nude images include AI-generated and deepfake images; filtering and monitoring checked at least annually, led by a senior leader with the DSL, with records kept.

• DfE filtering and monitoring standards (Meeting digital and technology standards in schools and colleges).

• UKCIS, Sharing nudes and semi-nudes: advice for education settings.

• DfE guidance on generative AI in education.

• Relationships, Sex and Health Education statutory guidance (revised, in effect from 1 September 2026), including misogyny, AI and deepfakes.

• Protection of Children Act 1978, Criminal Justice Act 1988 and Coroners and Justice Act 2009: making, possessing or sharing an indecent image of a child is a crime, and this includes computer-generated and AI-generated images.

• UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

4. Roles and responsibilities

5. The risks

Generative AI runs through all four. It can produce harmful content on request, chatbots can form "relationships" and give unsafe advice, and apps can create fake nude images of real people.

6. Our systems

6.1 Managed devices

• Learners use only Care Cove laptops and devices. Each learner has their own login, so activity can be traced to the right person.

• Devices are used in shared spaces with staff present, never by a learner alone in a closed room.

• The Tech Steward (a Space Keeper job) helps make sure laptops are charged, counted and locked away at the end of each day.

• Staff use Care Cove managed devices for all learner information. Devices lock automatically, and access to Connect can be revoked at once if a device is lost or a member of staff leaves.

6.2 Filtering

• All learner and staff devices are filtered and monitored by a system that meets the DfE filtering and monitoring standards, applied on each device so it works on any network, including off site.

• We require our provider to be a member of the Internet Watch Foundation, to block the police Counter Terrorism Internet Referral Unit list and to block illegal content including child sexual abuse material.

• Filtering blocks pornography, gambling, self-harm, violence, extremism, malware and proxy or VPN sites, without blocking reasonable learning. Staff report any site that is wrongly blocked; the DSL or Director decides whether to unblock it and the change is logged.

6.3 Monitoring and alerts

We combine physical and technical monitoring:

• Physical: staff are in the room whenever learners use devices and can see the screens.

• Technical: monitoring software on learner devices flags searches, sites and typed content of concern.

• Alerts: serious alerts (self-harm or suicide, sexual content involving children, grooming, extremism, violence or weapons) go immediately to the DSL and the Director. The DSL, or the Deputy when the DSL is away, reviews the full monitoring log every delivery day.

• Each alert the DSL acts on is recorded on Connect as a safeguarding concern or a "no further action" decision with reasons.

6.4 Annual check

The Director leads a check of filtering and monitoring with the DSL at least once a year, and again after a safeguarding incident, a new type of device, a change of provider or a change in guidance or risk. The check covers:

• who is responsible for what, and whether they know it;

• a test of the filtering on every type of device, across the main blocked categories;

• whether alerts reach the right people quickly;

• what incidents and logs show, and whether blocking is too tight or too loose;

• staff understanding of their role.

The check and its actions are recorded on Connect and reported to the SWMC.

7. Learner phones and personal devices

Every learner phone goes into the learner's own locker at reception on arrival and comes back at the door, covering lessons, breaks and lunch. Smartwatches and other connected devices are treated the same. This means learners go online on site only through our managed, filtered and monitored devices. Any exception for medical need, disability or caring is written into the learner's plan, with limited use in a set place. The Mobile Phones and Digital Devices policy gives the detail.

8. Teaching online safety

Online safety is taught through the RESET Tech mastery pillar, IT lessons and the Respect pillar, in line with the revised RSHE guidance. Learners learn:

• how apps are designed to keep them scrolling: notifications, infinite scroll and recommendation algorithms;

• social media and mental health, and gaming, loot boxes and gambling-style features;

• sextortion and online exploitation, and exactly how to report them;

• how AI and deepfakes work, and the law on fake images;

• their digital footprint and how employers see it;

• data and privacy, and how to recognise and report harmful content, contact and conduct;

• making things online instead of just scrolling.

Learners know their reporting routes: any trusted adult here, the Student app's route to tell a trusted adult, Childline (0800 1111), the CEOP Safety Centre run by the National Crime Agency, and the Childline and Internet Watch Foundation Report Remove tool.

Families are partners. The Family Tech Plan, the half-termly Sleep and Screens workshop (including setting up controls on the family's own phones) and the Digital Detox Challenge carry the learning home, where most screen time happens.

9. Responding to incidents

9.1 For every incident

1. Make sure the learner is safe. Listen, stay calm and do not promise to keep it secret.

2. Tell the DSL immediately, in person or by phone, and record it on Connect the same day.

3. Do not look through a learner's device. If it may hold evidence of harm, secure it and pass it to the DSL, as the Searching, Screening and Confiscation policy sets out.

4. The DSL decides within the hour on contact with parents and the school, Early Help, a referral to the Sheffield Safeguarding Hub (0114 273 4855) or the police, and reporting to the platform.

9.2 Nudes and semi-nudes, including AI-generated images

If a learner tells you about a nude or semi-nude image, or you find one:

• do not view, copy, print, save, share or forward it, and never ask a learner to show or send it to you. If you see one by accident, tell the DSL;

• do not delete it or ask the learner to delete it;

• do not question the learner about what happened; that is for the DSL;

• do not tell other staff, learners or parents; the DSL decides who needs to know;

• do reassure the learner that they have done the right thing and will be helped, without blame or shame;

• do tell the DSL straight away.

This applies equally to AI-generated, edited and deepfake images. The DSL follows the UKCIS guidance and always involves the police and the Hub where an adult is involved; there is coercion, blackmail or grooming; there are concerns about a learner's capacity to consent; the images show acts that are unusual for the learner's age or are violent; a child under 13 is involved; or a learner is at immediate risk of harm. The DSL can help the learner use Report Remove. Each learner involved, including any who shared images, gets separate support under KCSIE Part Five.

9.3 Sextortion

Sextortion is blackmail: someone threatens to share sexual images unless the young person pays or sends more. Criminal gangs often pose as young people, and boys are frequently targeted. Tell the learner it is not their fault and they are not in trouble, and tell them not to pay and not to reply. Do not delete messages or accounts, as they are evidence. The DSL contacts the police and the Hub and checks for risk of self-harm. If there is urgent risk, the learner is never left alone and the urgent clinical risk procedure in the Safeguarding and Child Protection policy applies.

9.4 Online grooming

Tell the DSL immediately. Never contact or confront the suspected groomer. Keep any evidence the learner has. The DSL refers to the Hub and the police, which may involve CEOP, and updates the learner's exploitation screening and contextual risk map.

9.5 Cyberbullying

Follow the Anti-Bullying policy. Record what happened, keep screenshots of messages (never of nude images), help the learner report and block, and involve parents. The DSL involves the police where there are threats, harassment, hate crime or image sharing.

9.6 Harmful content, self-harm and extremism

Self-harm or suicide content, or a learner searching for it, goes to the DSL at once and may trigger the urgent clinical risk procedure. Extremist content follows the Prevent and Counter-Extremism policy.

10. Staff use of technology

10.1 Accounts and passwords

• Care Cove Connect gives each person access only to what their role needs. Anyone can raise a safeguarding concern, but only permitted roles can read them.

• Multi-factor authentication (MFA) is used on Connect and Care Cove email in line with our security arrangements.

• Use a long, unique password (three random words works well), never reuse or share it, and change it straight away if you think it is known.

• Lock your screen whenever you step away. Connect times out automatically.

10.2 Devices and learner data

• Learner data is used only on Care Cove managed devices, never on personal phones, laptops, email, cloud storage, memory sticks or messaging apps.

• Report a lost device or suspected data breach to the Director immediately. The Director decides on notifying the Information Commissioner's Office within 72 hours where reportable, tells the commissioning local authority immediately, and the SWMC reviews every breach.

10.3 Contact with learners and families

• Contact learners and families only through Care Cove phones and Connect (the Family portal's secure messaging and the Student app). Never use personal phones, personal social media, personal email or gaming platforms.

• Do not send or accept friend or follow requests from current learners, or from former learners under 18.

• Keep contact to working hours unless the learner's plan says otherwise, for example during travel training, and record significant contact on Connect.

• If a learner contacts you on a personal account, do not reply. Tell the DSL and record it.

• Any live online session with learners, for example during a closure, uses only a platform the Director has approved, with parents told in advance.

10.4 Photos, video and social media

• Take photos or video of learners only on Care Cove devices, only with written consent recorded on Connect, and store them only in approved Care Cove storage.

• Care Cove social media never names learners. By default we use images in which learners cannot be recognised; a recognisable image is used only with the specific written consent described in the Photography, Images and Social Media policy. We do not post about our contracts or use a commissioning local authority's name or logo without its written consent.

• On your personal social media, keep your accounts private and never post about learners, families, colleagues or incidents at work. Your conduct online must meet the Staff Code of Conduct.

• Do not use your personal phone in front of learners (see the Mobile Phones and Digital Devices policy).

11. Generative AI

11.1 Staff

• Use only AI tools the Director has approved after a data protection check. The approved list is kept on Connect. If a tool is not on it, assume it is not approved.

• Never put personal data about learners, families or staff into an AI tool unless the Director has approved that tool for that use. Personal data includes names, case details, safeguarding information and photos.

• You may use approved tools for planning and resources without personal data. Check every output for accuracy, bias and suitability; you remain responsible for it.

• Never use AI to write safeguarding records, make decisions about a child, or create images of real learners or staff.

11.2 Learners

• Learners use only AI tools on the Director's approved list that are marked for learner use and that the tool's own terms allow for their age. They use them only for tasks a teacher sets, on our managed devices and under supervision.

• They are taught how AI works, how it gets things wrong, how chatbots and AI "companions" can manipulate, and the law on fake images.

• Learners must not use AI to create images or video of real people, sexual content, or anything that bullies or deceives. Creating a sexual image of anyone under 18, even with AI, is a crime.

• Work for qualifications follows the exam board and Joint Council for Qualifications rules on AI, through our partner exam centre.

12. Monitoring and review

The DSL reports online safety incidents and alert trends to the SWMC termly. The annual filtering and monitoring check is recorded and reported to the SWMC, and the annual independent external safeguarding audit covers online safety. This policy is reviewed annually, or sooner after an incident, a change in law or guidance, or a contract change.

13. Related policies

• 01 Safeguarding and Child Protection
• 05 Prevent and Counter-Extremism
• 07 Behaviour, Rewards and Restorative Practice
• 09 Searching, Screening and Confiscation
• 10 Mobile Phones and Digital Devices
• 13 Curriculum, Teaching and Assessment
• 17 Data Protection, Retention and Information Sharing
• 20 Business Continuity and Emergency Closure
• 21 Staff Code of Conduct
• 29 Anti-Bullying
• 35 Photography, Images and Social Media

Appendix A: Learner acceptable use agreement

My online safety promise

At Care Cove:

• I put my phone and smartwatch in my locker when I arrive. I get them back when I leave.

• I only use my own login. I keep my password to myself.

• I use Care Cove laptops for learning. I know staff can see what I do on them.

• I do not try to get round the filter, for example with a VPN.

• I only use AI tools that staff say are OK.

• I do not take photos or videos of anyone here.

Everywhere, online and offline:

• I treat people online the way I want to be treated. No put-downs, no filming or sharing anyone.

• I do not send nudes, ask for them or share anyone else's. Making fake nude pictures of someone is a crime too.

• If someone online asks me for pictures, money or to keep a secret, or threatens me, I stop replying and I tell an adult. It is not my fault, and I will not be in trouble for asking for help.

• If I see something that worries or upsets me, I tell a member of staff, use the Student app, or call Childline on 0800 1111.

Learner name and signature:

Parent or carer name and signature:

Key mentor name and signature:

Appendix B: Staff, partner and volunteer acceptable use agreement

I will:

• use Care Cove Connect and Care Cove devices only for my work, and access only what my role needs;

• keep my password private, use MFA where it is required, and lock my screen when I step away;

• keep learner and family information only on Care Cove managed devices and systems, never on my own devices, email, cloud storage or messaging apps;

• report a lost device or possible data breach to the Director immediately;

• contact learners and families only through Care Cove phones and Connect, and never through personal accounts;

• not send or accept friend or follow requests from current learners or former learners under 18;

• take photos or video of learners only on Care Cove devices with recorded consent;

• not put personal data into any AI tool that has not been approved for that use;

• not use my personal phone in front of learners;

• supervise learners whenever they use devices, and report any online safety concern to the DSL straight away;

• never view, copy or forward a nude or semi-nude image of a learner;

• keep my own social media private and never post about learners, families, colleagues or work.

I understand that Care Cove systems are monitored, and that breaking this agreement may lead to disciplinary action or a low-level concern or allegation being recorded.

Name, role and signature:

Appendix C: Visitor acceptable use agreement

While I am at Care Cove I will:

• not take photos, video or audio recordings of learners;

• not use my phone in learner areas, except where agreed with staff;

• not connect to Care Cove devices or networks unless staff give me access;

• not share any information about learners that I see or hear;

• tell the member of staff escorting me straight away if I see or hear anything that worries me about a learner's safety.

Name, organisation and signature:

Document control and ratification

This policy is signed off by the Designated Safeguarding Lead and the Head of Alternative Provision, and ratified by the Social Work Management Committee. It is reviewed every year, or sooner after an incident or a change in law, statutory guidance or contract requirements, and it is available to any commissioning local authority on request.