Data Protection

The AI models Rflect uses, and every change to them and to our AI-supported features, as set out in our Data Processing Agreement (DPA, Sections 2.6(f) and 2.6(g)).

Last updated

AI models in use

Anthropic Claude models running on AWS infrastructure; Anthropic has no access to the data. Each feature uses one fixed model. Categories A (text only) and B (with identifiers) are those of DPA Annex 4.

Model and AI feature changes

A change of model within the same provider is evaluated against a fixed evaluation set before release and listed here (DPA 2.6(g)). New or changed AI-supported features fall into the risk categories of DPA Annex 4:

1
A change to a feature in category A or B that adds no new category of personal data to a prompt, no new recipient and no new sub-processor. Listed here.
2
A new AI capability for lecturers on shared content, within the purpose of the DPA, that adds no new category of personal data to a prompt, no new recipient and no new sub-processor. Listed here and announced to your administrators at enablement, with a 30-day objection right.
3
A new category of personal data in a prompt, AI processing of private reflections without the student's opt-in, a decision with legal or similarly significant effect taken by the AI, or a new AI provider or inference region. Notified to you in writing 30 days in advance, with a joint review on request and an update of Annex 4 before enablement (DPA 2.6(f), 5.2).

Teaching Assistant: new conversations use Claude Opus 5.5 instead of Claude Sonnet 5.5. Existing conversations move to Opus 5.5 in a separate maintenance update. Model change under DPA 2.6(g).

First publication of the models in use, listed above.

Documents

Available on request

Institutions using Rflect can request from our data-protection contact:

Data-protection contact: privacy@rflect.ch