Healthy School Lunch ordering platform
New Zealand
Re: MoE Healthy School Lunch Programme extension
muhammadasim@codeaza.org · codeaza.com
All amounts in NZD
The scope document supersedes the July requirements list. It describes a national, government-scale platform — parents pre-ordering funded lunches in bulk across all public schools, integrated with menus, dietary rules, delivery and production.
We recommend proving the platform on a fixed-price pilot first — 4 schools, ~1,200 students, funded lunches only, no payments — then scaling to the full national build once the model is validated. Privacy Act compliance, encrypted data and role-based access are built in from the first record; PCI genuinely waits until payments are introduced. The figures below keep the pilot, the national build and ongoing support cleanly separate.
The Full Pilot delivers every item in the document not marked "future state," across four build stages:
Discovery, architecture & design sign-off
Compressed — we already hold the scope document. Lock the data model, ordering-rules taxonomy, school-selection model and target architecture.
- Ordering-rules and menu-cycle model
- School-selection model (single-site vs per-school)
- Target architecture, security & data-handling plan
- UAT plan and acceptance criteria
Core build — portals, menu & ordering
Parent, school-admin, programme-admin and operations portals; menu management with year-level segmentation and rotating cycles; bulk term ordering with absence edits; dietary/allergy engine; email + SMS.
- Auth: email/password + Google & Apple sign-in
- Parent + child management, school database & settings
- Menu mgmt (Yrs 0–3 / 4–8 / 9–13, up to 3× options/day)
- Bulk term ordering, absence edits, quick reorder
- Dietary & allergy engine with auto-hide of conflicts
Ops, rules engine & QA hardening
The operations/production layer, configurable rules engine, full reporting, and the security hardening that makes it launch-ready.
- Operations portal: production planning, manifests, run sheets, wastage
- Configurable ordering rules engine (cut-offs)
- Reporting suite (by student / school / region)
- Privacy Act, encryption & RBAC hardening
UAT, data load & launch
User acceptance testing, defect resolution, loading of the 4 pilot schools + menus, and go-live readiness ahead of Term 4.
- UAT support + defect resolution
- Load 4 schools + term menus (or CSV-roster fallback)
- Production deploy on AWS Sydney
- Go-live readiness sign-off
Security from day one: NZ Privacy Act compliance, encrypted personal data (at rest & in transit), role-based access control. PCI deferred — no payments in the pilot.
Term 4 starts Mon 12 Oct 2026; parents order beforehand, so the platform must be live, tested and loaded with schools + menus by Fri 25 Sep. From today that is ~7–8 working weeks with a dedicated 4-person squad.
Also required by ~15 Sep: school + menu content to load, plus Apple/Google developer accounts and Twilio NZ sender-ID provisioned on day one.
A $5,000 project fee secures the start date and mobilises the team; the $30,000 balance is split evenly across a mid-project milestone and final acceptance. Invoiced against milestones, 14-day terms.
Band only — scoped properly after the pilot, which becomes the production foundation. Final figure depends on true concurrency, data-residency and integration phasing.
Excludes infrastructure & tooling — billed separately, at cost:
• Hosting: AWS Sydney (ap-southeast-2), ~NZD $1,000/mo
• Monitoring tooling (Grafana + Sentry): ~NZD $100–$150/mo
• SMS via Twilio: 2,000/mo included, then ~$0.12/SMS
These accounts (AWS, Grafana/Sentry, Twilio) are owned and paid directly by WeTalk.ai; Codeaza sets them up and operates them on your behalf.
Hosting — billed separately, at cost: AWS Sydney (multi-AZ + DR), ~NZD $2,000–$3,000/mo, scales with term-ordering peaks.
Monitoring tooling (Grafana + Sentry): at cost, scales with volume.
Support fees above are for maintenance & support only — cloud hosting is billed separately at cost. If a strict NZ data-residency mandate applies we would host on a NZ provider (e.g. Catalyst Cloud) — this changes the hosting figure. Please flag if required.
Validity. This quotation is open for acceptance for 30 days from the issue date and is superseded by any subsequent written quotation.
Intellectual property. All source code, models and documentation in the delivered platform are owned by WeTalk.ai Limited on final payment. Codeaza retains only its pre-existing, non-client-specific tooling and frameworks. This basis does not change the figures quoted.
Change control. Scope changes are estimated in writing and take effect only on written approval by both parties. The pilot is priced on a frozen scope.
Confidentiality. Both parties treat commercial and technical information exchanged as confidential under the executed NDA.
Data handling. Children's personal data is processed under NZ Privacy Act obligations, encrypted at rest and in transit, on AWS Sydney (or a NZ provider if residency is mandated).
Liability. Codeaza's aggregate liability is limited to the fees paid under this engagement. Neither party is liable for indirect or consequential loss.