← All work
04

Case Study · Toddle · 2024–2026 · 20 months

Designing trust into student welfare.

Role
Sr Product Designer — design lead
Timeline
20 months · 6 release phases
Beta
28 schools · 12+ countries
AI
In product + in workflow
28
Beta schools across 12+ countries from day one
9
Competitors mapped across 60+ dimensions
6
Market gaps identified — now core roadmap differentiators
AI
Behaviour summaries shipped on day one of beta

Context

A pastoral care system built from scratch — for schools that couldn't afford it to fail.

Behaviour Management is Toddle's pastoral care system — where schools log, track, manage, and analyse student behaviour events. The module name itself is configurable: "Behaviour Management" in UAE, "Pastoral Care" in UK, "Wellbeing" in schools using restorative approaches. A school practising restorative approaches actively rejects the "Behaviour Management" framing. This naming layer is a precondition for adoption in several markets.

A missed notification in a consumer product is an inconvenience. A missed referral in a pastoral context can mean a coordinator doesn't act on a situation involving a student's welfare. That difference shaped every single design decision in this module.

28 beta schools across

UAESaudi ArabiaJordanEgyptTanzaniaLatviaIndonesiaIndiaAustralia
PYP · MYP · DP · Cambridge · IB · UbD
GDPR · NCCD · UAE MoE · CEWA safeguarding

The Problems

Five failures that stopped schools from switching it on.

01 — Adoption blocker

Schools refused to enable the module at all

Behaviour incidents were shared with the entire "school administrators" role group — IT staff, librarians, nurses, finance staff. None of these people should see sensitive pastoral records. Schools refused to go live until this was fixed. A safeguarding system schools won't switch on is a failed product.

02 — Notification noise

The notification system had destroyed its own signal

A coordinator with broad role-based visibility was receiving a push notification every time any teacher logged any incident. In active schools: dozens per day. Within a week, coordinators were muting the app entirely. Indirect access and direct sharing were treated identically. They are not the same thing.

03 — Teacher friction

Multi-student incidents required logging each student separately

A classroom disruption involving 6 students required 6 separate incident creations. Teachers either skipped logging or batched records at the end of the week from memory, losing accuracy. Every major competitor supported bulk creation. Toddle didn't.

04 — Safeguarding gap

Referrals disappeared with no accountability lifecycle

A teacher could refer an incident to a coordinator — but there was no accept/reject/close lifecycle. Referrals disappeared with no review trigger. Coordinators didn't know what was pending. Teachers didn't know if their referral had been acted on. This is a safeguarding accountability gap, not a workflow gap.

05 — Scale

No account-level governance for school networks

CEWA (40+ Catholic schools in Western Australia) couldn't define central Wellbeing Framework categories and push them to all schools. Every school configured independently. Category names proliferated. Behaviour data couldn't be meaningfully aggregated across a network.

"Indirect access and direct sharing were treated identically. They are not the same thing. This single distinction rebuilt the notification model."

Key Decisions

The design calls that defined the system.

Notifications

Indirect access does not trigger notifications

If a coordinator's role grants "view all incidents," they have permission to see every incident — but they don't get notified about every one. Indirect access (passive, role-based) is ambient availability. Direct sharing (a teacher specifically adding someone) fires a notification. The permission model and the notification model intentionally diverge. This deliberate inconsistency is what makes the system usable.

Data integrity

No unpublish — ever

Publishing is the conscious institutional commitment: "this happened to this student." Once published, the student field is locked permanently. The case for unpublish: error recovery. The case against: it undermines the audit trail's meaning. A pastoral record that can be unpublished is a pastoral record that can be made to not have happened. In a safeguarding context, that's the wrong affordance.

Multi-student

Two mental models, clearly delineated contexts

Standard incidents: identical records per student, fast, one action. Counter-bullying category only: role-based participants (aggressor, victim, witness), because points should apply only to the aggressor. Schools either use Counter-bullying or archive it — they never encounter both models in the same flow.

Transparency

Default outcome footer preview on creation

When a teacher selects a sub-category, a footer previews exactly what will be auto-applied: "This incident will be shared with the student, family members, 5 staff members and 4 actions will be automatically applied." In a system where notifications have real consequences — parent calls, student records, staff escalations — the person triggering the action should never be surprised by what it does.

AI in this project

AI wasn't a feature note. It was how the work got done.

AI showed up in three specific and distinct ways — not as a tagline, but as infrastructure.

In the product, day oneAI-generated behaviour summaries on student profiles shipped in the August 2024 beta. Roadmap moves from AI that summarises to AI that recommends next actions.
In research9-competitor analysis across 60+ functional dimensions — compressed from weeks to a structured sprint using AI-augmented research synthesis.
In PRD authoringThe Point System PRD: 14 sections, 7 explicit open decisions surfaced before engineering started. AI-augmented structural drafting and edge case enumeration.
In documentationThis retrospective — synthesised from 80 pages of PRDs and 46+ Coda pages — is itself the output of AI-augmented knowledge management.

What I Learned

The things pastoral design taught me.

1
Pastoral notifications carry a different weight.A missed notification in a consumer product is an inconvenience. A missed referral can mean a coordinator doesn't act on a situation involving a student's welfare. Every default setting is a value judgment, not a UX choice.
2
Teacher friction is the number one adoption killer.The module is designed by power users thinking in coordinator workflows but used daily by class teachers under time pressure. Teachers don't complain — they stop logging.
3
AI in product is a day-one feature, not a phase 2 aspiration.AI behaviour summaries shipped in the August 2024 beta. The constraints — privacy, prompt calibration — are practical, not conceptual. The path from summaries to intervention suggestions is a straight line.
4
Beta diversity does the work of formal regulatory research.A homogeneous beta would have missed the UAE MoE scorecard requirement, Latvia's GDPR considerations, and CEWA's NCCD compliance surface. The 28-school diversity is why the module is architecturally sound for global deployment.
← Back to all work