Student Data Privacy Agreement

How to read this draft: clauses marked Applies to cloud sync apply only when a user has turned on cloud sync in IEP Atlas Pro. In the default local mode, no student data is transmitted to or stored by the Provider, and those clauses have nothing to operate on.

Parties

This Student Data Privacy Agreement (the “Agreement”) is between [Provider legal entity name], located at [Provider address] (the “Provider”), operator of IEP Atlas, and the local education agency, school, or individual licensed professional identified in the signature block or, for individual subscribers, the account holder who accepts it (the “Subscriber”). Where the Subscriber is an individual acting under the authority of a school or district, the term “LEA” refers to that school or district.

Article 1. Purpose and scope

1. The Provider offers (a) a goal library, builder, and related tools that do not require student data, and (b) a caseload workspace that stores student data locally on the user's device by default. This Agreement governs the optional cloud sync feature of the workspace, under which Student Data is transmitted to and stored by the Provider on the Subscriber's behalf (the “Service”). Applies to cloud sync
2. “Student Data” means any information about a student that the Subscriber enters into the Service, including names, dates of birth, grade, school, disability category or eligibility, IEP and evaluation dates, services and minutes, goals, baselines, performance data, session notes, and, where the Subscriber chooses to enter it, a Medicaid identifier. Student Data includes education records as defined by the Family Educational Rights and Privacy Act (FERPA) and any additional categories defined by the law of [State].
3. This Agreement is incorporated by reference into the IEP Atlas Terms of Use for any account with cloud sync enabled. If this Agreement conflicts with the Terms of Use or the Privacy Policy on the handling of Student Data, this Agreement controls.

Article 2. Data ownership and control

1. Student Data remains the property of, and under the control of, the Subscriber and, where applicable, the LEA. The Provider acquires no rights in Student Data other than the limited license needed to provide the Service. Applies to cloud sync
2. The Subscriber may export all Student Data in a machine-readable format at any time, without charge, using the export functions of the Service.
3. Parents and eligible students retain all rights to inspect, review, and request correction of education records under FERPA and state law. Those requests are directed to the LEA. The Provider will assist the Subscriber in fulfilling such a request within ten (10) business days of a written request.

Article 3. Permitted use; no unauthorized use or disclosure

1. The Provider will use Student Data only to provide, maintain, secure, and support the Service for the Subscriber, and for no other purpose. Applies to cloud sync
2. The Provider will not sell, rent, or trade Student Data; will not use it to build a profile of any student for any purpose other than supporting the Subscriber's authorized educational use; and will not use it to train or improve machine-learning models.
3. The Provider will not disclose Student Data to any third party except (a) to Subprocessors under Article 5, (b) as required by law under Article 4, or (c) at the written direction of the Subscriber.
4. Provider personnel with access to Student Data are limited to those who need it to operate or support the Service, are bound by confidentiality obligations, and receive privacy and security training. Support staff access the Subscriber's workspace only with the Subscriber's permission for a specific support request.

Article 4. Third-party requests

1. If the Provider receives a subpoena, court order, or other legal demand for Student Data, it will notify the Subscriber promptly and before complying, unless legally prohibited from doing so, so that the Subscriber or LEA may seek a protective order. Applies to cloud sync
2. If a parent, eligible student, or other person asks the Provider directly for access to or deletion of Student Data, the Provider will refer the request to the Subscriber and will not act on it independently, except where required by law.

Article 5. Subprocessors

1. The Provider uses a small number of infrastructure vendors (“Subprocessors”) to host and operate the Service. The current list, each vendor's purpose, and the region where data is stored are published at /legal/subprocessors. Applies to cloud sync
2. Each Subprocessor is bound by a written agreement with data-protection obligations at least as protective as this Agreement for the functions it performs.
3. The Provider will update the published list at least thirty (30) days before adding a Subprocessor that will process Student Data, and will notify Subscribers with cloud sync enabled by email. A Subscriber who objects may terminate under Article 13 and export or delete its data before the change takes effect.
4. Student Data is stored and processed in the United States.

Article 6. Subscriber duties

1. The Subscriber represents that it has the authority to enter Student Data into the Service, including any consent or designation required by the LEA, by state law, or by a parent, and that doing so complies with the LEA's policies on third-party tools.
2. The Subscriber will keep its account credentials confidential, will not share an account between people, and will notify the Provider promptly of any suspected unauthorized access.
3. The Subscriber is responsible for the accuracy of Student Data and for entering only the minimum data needed for its purpose.
4. The Subscriber acknowledges that documentation exported from the Service, including Medicaid-oriented service logs, is a support document prepared from the Subscriber's own entries. It is not a claim, is not reviewed by the Provider, and does not establish eligibility or reimbursement. The Subscriber remains responsible for its LEA's billing and consent procedures.

Article 7. Provider duties and FERPA designation

1. To the extent the Provider receives education records from an LEA or its staff, the Provider agrees to act as a “school official” with a legitimate educational interest under 34 CFR §99.31(a)(1)(i)(B): it performs a service the LEA would otherwise perform with its own staff, is under the LEA's direct control with respect to the use and maintenance of education records through this Agreement, and will not redisclose records except as permitted by this Agreement and 34 CFR §99.33. Applies to cloud sync
2. The Provider will comply with the requirements of this Agreement and with applicable federal and [State] student-privacy law.
3. The Provider will provide the Service in a way that lets the Subscriber meet its own obligations to parents and eligible students, including export, correction, and deletion.
4. The Provider does not represent that use of the Service makes the Subscriber or LEA compliant with FERPA, IDEA, HIPAA, or any state law. Compliance depends on how the Subscriber uses the Service and on the LEA's own policies.

Article 8. Aggregate and de-identified data

1. The Provider may create and use de-identified data (for example, counts of goals by skill area or average sessions per week across all users) to operate, evaluate, and improve the Service, provided that the data cannot reasonably be used to identify a student, a user, or an LEA, and provided that the Provider does not attempt to re-identify it and contractually prohibits any recipient from doing so. Applies to cloud sync
2. De-identification will, at minimum, remove direct identifiers and dates tied to individuals, and will suppress any aggregate that describes fewer than [minimum cell size, e.g., 10] students or users.
3. The Provider will not publish or share de-identified data derived from Student Data without describing the practice in its Privacy Policy.

Article 9. Data retention and disposition

1. The Provider retains Student Data only while the Subscriber's account has cloud sync enabled, plus the retention periods below. Applies to cloud sync
2. When a Subscriber deletes a student record, turns off cloud sync, or deletes the account, the Provider will delete the corresponding Student Data from active systems within thirty (30) days, and from encrypted backups within ninety (90) days. Backups are not restored except to recover from a system failure, in which case deleted data is re-deleted.
3. If a Pro subscription lapses without the account being deleted, cloud sync is paused. Student Data already stored remains available for export for ninety (90) days after the lapse, after which it is deleted under paragraph 2 unless the Subscriber restores the subscription.
4. On written request, the Provider will confirm deletion in writing. The Subscriber is responsible for exporting any data it needs to keep before deletion.
5. If the Provider ceases to operate the Service, it will give Subscribers at least sixty (60) days' notice and an export path before deleting Student Data.

Article 10. Advertising and marketing prohibition

1. The Provider will not use Student Data, or any information derived from it, for advertising, marketing, or targeting of any kind, whether to students, parents, Subscribers, or anyone else. Applies to cloud sync
2. The Service displays no third-party advertising. The Provider does not share Student Data with advertising networks or data brokers.

Article 11. Security measures

1. The Provider maintains administrative, technical, and physical safeguards appropriate to the sensitivity of Student Data, including at minimum: Applies to cloud sync
   • encryption of Student Data in transit (TLS 1.2 or higher) and at rest;
   • per-account access control enforced at the database layer, so that one user's data cannot be read by another;
   • authentication through emailed sign-in links or equivalent, with session expiry;
   • least-privilege access for Provider staff, with administrative access logged;
   • separation of production from development and test environments, with no Student Data in non-production systems;
   • regular review of dependencies and Subprocessor security attestations; and
   • a written incident-response procedure.
2. On request, no more than once per year, the Provider will provide a written summary of its security program and its Subprocessors' current compliance reports, subject to confidentiality.

Article 12. Breach notification

1. A “Security Incident” is any unauthorized access to, acquisition of, disclosure of, or loss of Student Data in the Provider's or a Subprocessor's custody. Applies to cloud sync
2. The Provider will notify the affected Subscriber by email at the address on the account within seventy-two (72) hours of confirming a Security Incident. The notice will describe what happened, the categories of Student Data and the students likely affected, the steps taken to contain it, and a contact point. The Provider will update the notice as the investigation continues.
3. The Provider will cooperate with the Subscriber and LEA in investigating the incident and in meeting their own notification obligations to parents, students, and [State] authorities. Where the law of [State] requires the Provider to notify individuals or regulators directly, the Provider will do so.
4. The Provider will bear the reasonable costs of notification caused by its own or its Subprocessors' breach of this Agreement.

Article 13. Term and termination

1. This Agreement takes effect when the Subscriber first enables cloud sync and continues until all Student Data has been deleted under Article 9. Applies to cloud sync
2. Either party may terminate at any time. The Subscriber terminates by turning off cloud sync or deleting the account. The Provider may terminate for material breach on thirty (30) days' written notice, or immediately if continued operation would violate the law.
3. Articles 2, 3, 4, 9, 10, 12, and 15 survive termination for as long as the Provider holds any Student Data, and Article 14 survives indefinitely.

Article 14. Governing law and disputes

This Agreement is governed by the laws of [State] and applicable federal law, without regard to conflict-of-law rules. Where the Subscriber is a public LEA, the Provider agrees that this Article does not waive the LEA's statutory venue or sovereign immunity protections. [Attorney: confirm venue and whether a state-specific addendum, e.g., California AB 1584 / SOPIPA, Illinois SOPPA, New York Ed Law 2-d, or Texas SB 820, must be attached.]

Article 15. General

1. Changes to this Agreement that reduce protections for Student Data require thirty (30) days' notice and the Subscriber's continued use after that period, or a signed amendment for LEA Subscribers.
2. Neither party may assign this Agreement without the other's consent, except that the Provider may assign it to a successor that assumes all obligations and gives Subscribers notice and an export window of at least sixty (60) days.
3. If any provision is unenforceable, the rest remains in effect.
4. Notices to the Provider go to the Privacy Officer: [Privacy officer name], [Provider address], support@iepatlas.com.

Signature block (LEA Subscribers)

[Provider legal entity name] — by: ______________________ name: ____________ title: ____________ date: ________
[LEA name] — by: ______________________ name: ____________ title: ____________ date: ________

Exhibit A: Categories of Student Data

• Identifiers: student name or initials, date of birth, grade, school, optional Medicaid identifier.
• Eligibility and IEP status: disability category (if entered), IEP dates, evaluation dates, transition dates.
• Services: service type, frequency, minutes, setting, provider name, start and end dates.
• Goals and objectives: goal text, baseline, target, measurement type, mastery rule.
• Performance data: session date and duration, cueing level, assistance level, scores, attendance and cancellation reasons.
• Notes: session notes, planning notes, to-dos that reference a student.

Questions about this draft: support@iepatlas.com. Districts that need a counter-signed copy or a state-specific addendum should contact us before enabling cloud sync.