SCI Methodology & Rights Notice
How your Skill Credibility Index is calculated, and your right to contest it.
Version 1.0 · In effect from 15 October 2026 · Permanent link to this version
1. Why this document exists
1.1 The Skill Credibility Index ("SCI") is a number we compute about you, automatically. The GDPR entitles you to "meaningful information about the logic involved, as well as the significance and the envisaged consequences" of that processing (Arts. 13(2)(f) and 15(1)(h)). This Notice gives you that information.
1.2 We treat the SCI as an automated decision within GDPR Art. 22, following the CJEU in C-634/21 SCHUFA (7 December 2023): where a score is produced wholly automatically and a third party draws strongly on it, the score is itself the decision. We do not argue about whether Art. 22 applies. We assume it does and give you the Art. 22(3) safeguards in section 9.
1.3 This Notice is referenced by the Privacy Policy, the Terms of Service and the Data Sharing Agreement, and prevails over shorter summaries of the SCI elsewhere.
2. What the SCI is
2.1 The SCI is a per-skill indicator on a 0–100 scale. You do not have "an SCI"; you have an SCI for Python, or for conversational Spanish, computed separately from the evidence for that skill.
2.2 It is computed only from Evidence Events about you in that skill. An Evidence Event is an immutable record, captured when it happened, of something you did on the Platform (a Session, an assessment, a practice drill), of a confirmation another User gave you, or of work you connected from GitHub, Figma or Vercel and whose ownership we checked. Nothing else feeds the score.
2.3 It answers one narrow question: how much verified evidence is there, on this Platform, that this person can currently do this skill?
3. What the SCI is not
3.1 It is not an intelligence or IQ test. It measures demonstrated activity, not cognitive capacity.
3.2 It is not a personality assessment. We do not infer, score or store traits such as conscientiousness, motivation or "coachability".
3.3 It is not a measure of your worth, character or trustworthiness as a person, and must not be presented or used as one.
3.4 It is not a background check. We do not screen criminal records, credit, immigration status, employment history or public records.
3.5 It is not a guarantee of competence. It is evidence of activity on one platform over a limited period. It can be high for someone who performs poorly in a particular job, and low for someone excellent who has simply not used Lemma much.
3.6 It is not a general-purpose reputation score. It exists for skill verification and nothing else (see section 8).
4. What feeds the SCI
The SCI is the sum of five components, each with its own cap, then limited to 0–100. The rules below are those of ruleset v4, the version in force. Each score records the ruleset version that produced it, so an old score can always be recomputed exactly.
| Component | Range | What it counts |
|---|---|---|
| Practice | 0 to 25 | Completed Sessions and AI-Tutor practice drills |
| Proof | 0 to 40 | Peer confirmations, assessments, connected external work |
| Reliability | 0 to 20 | Turning up to Sessions you booked |
| Freshness | 0 to 15 | How recently you produced evidence |
| Integrity | −30 to 0 | Deductions for patterns that look manufactured |
4.1 Practice (up to 25)
4.1.1 Completed Sessions (up to 20). Each Session you complete in the skill adds points according to the rating you gave the Session in your own post-session reflection: 5 stars adds 5, 4 stars 4, 3 stars 2.5, 2 stars 1, 1 star 0. A Session without a reflection rating adds 3. A Session in which you taught counts 1.5 times. A Session counts as completed when both participants joined it; cancelled and no-show Sessions add nothing here. 4.1.2 AI-Tutor practice drills (up to 5). Each structured practice exercise you pass adds 1 point. An exercise is passed when its AI-scored result is at least 70%. Conversation with the AI Tutor does not count, and the content of your AI-Tutor conversations is not used for the SCI.
4.2 Proof (up to 40)
4.2.1 Peer confirmations (up to 12). Another User can confirm that you have the skill. Each confirmation adds 4 points. Each User's confirmation counts once per skill. 4.2.2 Assessments (up to 15). Only your best result counts. A skill assessment adds 8, 10 or 12 points for a result of at least 60%, 75% or 90%. A certification assessment adds 10, 12 or 15 at the same thresholds and replaces the skill-assessment points if higher. Each failed assessment deducts 2 points from Proof, up to 6 in total. 4.2.3 Connected external work (up to 6). Each verified piece of work from GitHub, Figma or Vercel adds 3 points. We check that the connected account owns the work; we do not judge its quality. 4.2.4 Organisation endorsements (up to 10). The ruleset allows 5 points per endorsement by a verified organisation. This input is not yet live: no endorsement can be given today, and none feeds any score.
4.3 Reliability (up to 20)
4.3.1 Each completed Session adds 1.5 points, up to 15. If you have 10 or more completed Sessions and have never had a no-show or late cancellation in the skill, you receive a further 5 points. 4.3.2 Each no-show in the last 30 days deducts 6 points (up to 15), and each late cancellation in the last 30 days deducts 3 (up to 9). Penalties older than 30 days no longer deduct points, but an older penalty still prevents the 5-point bonus. Reliability cannot fall below 0.
4.4 Freshness (up to 15)
See section 5.
4.5 Integrity (0 to −30)
4.5.1 If you have at least 5 Sessions in a skill and more than half of them are with the same partner, we deduct up to 15 points, rising with the share. 4.5.2 If at least 3 peer confirmations come from at least 2 people and more than 70% of them are reciprocal (you confirmed each other), we deduct up to 15 points. 4.5.3 The total integrity deduction is capped at 30 points. A deduction is reviewed by a person on request (section 9).
4.6 How assessments are run and scored
4.6.1 Assessments are computerised adaptive tests of 15 to 25 questions. The difficulty of each question adapts to your previous answers; the test ends when your level stabilises or at 25 questions. The result is a difficulty-weighted score from 0 to 10, and 6.5 is a pass. Retakes are allowed after a waiting period and are recorded as retakes. 4.6.2 Questions are generated by an AI model for each attempt, and some answers (for example, explanations of a code fix) are scored by an AI model against a rubric. Multiple-choice answers are scored automatically. During an assessment we record integrity signals (switching tabs, copying and pasting, opening developer tools); they appear in the result and can lower an integrity indicator, but they never change the SCI by themselves. See the AI Transparency Notice.
4.7 Levels shown to others
4.7.1 Alongside the number, the SCI is expressed as a level: newcomer (below 15), learner (15), proven (35), verified (55), expert (75) and authority (90). The level is derived only from the number.
5. Freshness
5.1 Why it exists. A skill demonstrated three years ago is weaker evidence than the same skill demonstrated last month. Freshness is what makes the SCI a statement about the present.
5.2 How it works. Freshness depends on your most recent qualifying Evidence Event in the skill:
| Most recent qualifying evidence | Freshness |
|---|---|
| Within 7 days, and you have at least 5 completed Sessions | 15 |
| Within 7 days | 10 |
| Within 30 days | 7 |
| Within 90 days | 3 |
| More than 90 days ago | 0 |
5.3 No gradual decay. Older Evidence Events keep counting in full in the other components; only Freshness depends on time. Inactivity alone can therefore cost at most 15 points, and new activity restores Freshness immediately.
5.4 Stale skills. If you have had no qualifying evidence in a skill for more than 90 days, the skill is marked stale on your Skill Passport, so that anyone viewing it knows the evidence is not recent.
5.5 Which events count. Only evidence of positive activity (a completed Session, a passed drill or assessment, a confirmation, connected work) refreshes Freshness. A no-show, a late cancellation or a failed assessment does not.
6. Counterfactual explanation — what would have to change
6.1 In C-203/22 Dun & Bradstreet Austria (27 February 2025) the CJEU held that information about the logic must explain the procedure and principles actually applied, in a form that lets you understand which of your data were used and how, so that you can check and contest the result. We do that through counterfactuals: what would have had to be different for the outcome to be different.
6.2 Worked example A — a score that fell without new activity. Your Python SCI was 60: Practice 20, Proof 16, Reliability 9, Freshness 15. You have not been active for five weeks, so Freshness has fallen to 3 and the SCI is now 48. Nothing needs correcting. One completed Session this week would raise Freshness to 10 again (15 once you have five Sessions in the skill), and the SCI to about 56–61.
6.3 Worked example B — a score capped by narrowness. Your Spanish SCI is 38: Practice 23 (twenty drills and several Sessions), Proof 4, Reliability 4, Freshness 7. Practice is capped at 25 and drills at 5, so more drills will not move the score. Proof would: a passed assessment at 75% adds 10 points, and two peer confirmations add 8.
6.4 Worked example C — a score held down by concentration. You have 12 Sessions in a skill, 9 of them with the same partner (75%). Integrity deducts 15 points. Sessions with other partners lower the share: once the same partner accounts for no more than half of your Sessions, the deduction disappears.
6.5 Our commitment. On request we give you an individualised counterfactual explanation for your own score: its actual composition by component, which Evidence Events contribute most, and the specific changes that would most efficiently move it. Ask at privacy@getlemma.io; we respond within 14 days.
7. What the SCI never uses — binding commitments
7.1 The following are never inputs to the SCI, in any form, direct or proxied. These are binding commitments, enforceable against us as part of the Terms of Service.
7.1.1 No protected characteristics. Not race, ethnicity, national origin, religion or belief, political opinion, trade union membership, health or disability, sex, sexual orientation, gender identity, age or genetic or biometric data.
7.1.2 No off-platform social behaviour. Nothing from social networks, no data brokers, no purchased profiles, no scraped public activity, no "who you know".
7.1.3 No inferred personality traits. We do not build or store a psychometric profile.
7.1.4 No emotional-state inference. We do not run emotion recognition on voice, faces or text. We do not record Sessions.
7.1.5 No private message content. Direct messages between Users, and the substance of AI-Tutor conversations, are never scored.
7.1.6 No data from unrelated contexts. Payment behaviour, subscription tier, support tickets, complaint history and browsing outside the skill context do not feed the SCI.
7.1.7 What paying changes, and what it does not. Every plan scores evidence with the same rules, and a given result earns the same points on every plan. Paid plans give more opportunities to produce evidence: more assessment attempts each month, certification assessments more often and shorter waiting periods between retakes. The free plan includes one certification assessment per quarter. See the Terms of Service for each plan's limits.
7.2 Purpose. The SCI is used for skill verification and the features in section 8, and for one related purpose: when we suggest Session partners, a teacher's track record with learners (including how learners' SCI in the skill developed after Sessions with them) is one of the factors in how suggestions are ordered. See the Terms of Service, section on how matching works. The SCI is never reused as a general trust, risk or eligibility signal in an unrelated context, and never sold as one.
7.3 These constraints — evidence about the skill only, used within the skill context, no off-platform social data, no protected characteristics — are why we consider the SCI to be outside the social-scoring prohibition in EU AI Act (Reg. (EU) 2024/1689) Art. 5(1)(c), in force since 2 February 2025.
8. Where your SCI is visible
8.1 To you: always, together with your full evidence log.
8.2 On your Skill Passport: your Skill Passport is private until you publish it. Once published, it shows the SCI for the skills on your record (up to the number your plan includes). You can unpublish your Skill Passport at any time, and it stops being visible immediately.
8.3 To an API Client through the Verification API: only with your separate, explicit, opt-in consent (GDPR Arts. 6(1)(a) and 22(2)(c)), given to one named organisation at a time, revocable at any time in Settings → Employer access and never bundled into acceptance of the Terms of Service. The same page lists every lookup each organisation made. Refusing or withdrawing consent affects nothing else in your account.
8.4 Users under 18 are excluded from the Verification API entirely. Consent to a Verification can only be given together with a confirmation that you are 18 or older; without it, nothing is disclosed. No SCI of a User under 18 may be disclosed to an API Client, whether or not they or a parent would consent.
9. Your rights
9.1 See your inputs. Each skill's page in the app shows the Evidence Events feeding its score, with their date, type and effect on the score. You can also ask for a complete copy at privacy@getlemma.io (GDPR Art. 15); your account data export (Settings) includes your current scores.
9.2 Human intervention (GDPR Art. 22(3)). You can require a competent person — not a system — to review your score. That person can see the underlying evidence, correct it, exclude it or override the score.
9.3 Express your point of view (Art. 22(3)). You can submit a written explanation, context or supporting material, and it is read by the reviewer before a decision is made.
9.4 Contest the score (Art. 22(3)). You can challenge the outcome itself, not merely the data behind it.
9.5 The SCI Review & Appeal process. Write to privacy@getlemma.io with the skill and what you dispute. We acknowledge within 3 working days and a human reviewer gives a written, reasoned decision within 21 days, explaining what we checked. If the score changes, the change is immediate and we tell any API Client to whom the disputed score was disclosed in the preceding 12 months. If it does not, you may escalate once to a different reviewer.
9.6 Correct the underlying data (GDPR Art. 16). If an Evidence Event is wrong — a Session logged that never happened, a confirmation from a duplicate account — tell us; we correct or remove it and recompute the score.
9.7 Withdraw the score. You can unpublish your Skill Passport, and withdraw any organisation's Verification access, at any time, immediately, without a reason and without penalty elsewhere on the Platform.
9.8 Complain. You may complain to the Office of the Commissioner for Personal Data Protection (commissioner@dataprotection.gov.cy, +357 22 818 456, www.dataprotection.gov.cy, 15 Kypranoros Street, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia)) or your local supervisory authority, and you may go to court. Using our appeal process first is not a precondition.
10. Accuracy, error and bias
10.1 No score is perfect. The SCI rests on a limited window of activity on one platform, and any statistical model errs in individual cases. We say so plainly; pretending otherwise would be a misleading practice under Law 112(I)/2021.
10.2 What we monitor. We test SCI outcomes at least every 6 months for systematic differences that the evidence does not justify, including differences correlated with language, region and account age. We test on aggregated, pseudonymised data; we do not collect protected characteristics in order to test for bias against them, and we say so rather than implying a completeness we cannot deliver.
10.3 What follows. We publish a summary of each review at https://getlemma.io — what was tested, what was found, what we changed. Where we find a problem we correct the model, recompute affected scores, and notify Users whose scores move materially.
11. Trade secrets
11.1 We protect the exact parameters, thresholds and anti-gaming rules of the model. Public, they would make the score trivially manipulable and worthless to everyone.
11.2 Trade secrecy is not a blanket refusal. Following C-203/22 Dun & Bradstreet, a controller cannot rely on trade secrets to refuse all explanation. You always get the information in this Notice and an individualised counterfactual explanation. Where a dispute requires more, we will disclose the full logic and parameters of the SCI to the Office of the Commissioner for Personal Data Protection, or to a competent court, under confidentiality protection, so the authority can verify what we tell you.
12. Governance to 2 December 2027
12.1 Today. AI Act Art. 5 prohibitions and Art. 4 AI literacy (since 2 February 2025, Art. 4 as amended by the Digital Omnibus, Reg. (EU) 2026/1744) and Art. 50 transparency (since 2 August 2026) apply — see the AI Transparency Notice. Annex III high-risk obligations do not yet apply.
12.2 From 2 December 2027. Annex III high-risk obligations begin, following the postponement in the Digital Omnibus (Reg. (EU) 2026/1744, in force since 27 July 2026). The SCI aggregation itself is rule-based and arguably not an "AI system" within Art. 3(1). But the assessments that feed it are generated and partly scored by AI models, and both the assessments (through the Assess API) and the SCI (through the Verification API) are offered to employers to evaluate candidates. We therefore plan on the basis that we are the provider of a high-risk AI system under Annex III point 4(a) (recruitment and selection), and possibly point 3(b) (evaluating learning outcomes), from that date.
12.3 Roadmap. By Q4 2026: a documented classification assessment, the Art. 10 data-governance foundations (dataset inventory, provenance log, first bias test) and Art. 12 logging — these are historical records and cannot be created retrospectively. During 2027: Art. 9 risk management, Art. 14 human oversight, Art. 15 accuracy and robustness testing, Art. 11 technical documentation, Art. 13 instructions for use for API Clients. Before 2 December 2027: conformity assessment, EU declaration of conformity and registration as required. The dated quarter-by-quarter version is in the AI Act Compliance Memorandum, §6. We will publish progress against these dates, including where we are behind.
13. Changes and contact
13.1 If we change what feeds the SCI, how it is weighted or how Freshness works, we update this Notice, publish the version history and tell affected Users in advance of a material change.
13.2 Questions and requests: privacy@getlemma.io. Data protection matters are handled by our privacy lead, reachable at the same address.