Draft for legal review. This text has not been approved by a lawyer and is not yet in force. Highlighted items must be confirmed before publication.

FERPA Statement

Last updated: [date of approval]

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records in the United States. SchoolWised is built to help schools keep those records private and under their own control.

[Lawyer to confirm: FERPA applies to schools that receive U.S. Department of Education funds. Many private schools do not, but follow FERPA as good practice. State student privacy laws may also apply.]

Our role

When a school uses SchoolWised, the school keeps ownership and control of its education records. SchoolWised acts as a service provider performing a function the school would otherwise do itself, under the school's direct control. In FERPA terms, we intend to act as a "school official" with a legitimate educational interest, as defined in the school's annual notification. [Lawyer to confirm wording and the contract clause that supports it.]

Our commitments

• We use education records only to provide SchoolWised to the school. Never for advertising, and never to build profiles of students.
• We do not sell student data, and we do not disclose it to third parties except the service providers needed to run SchoolWised, or when required by law.
• The school decides who sees what. Staff sign in with their school Google accounts. Teachers see only their own classes; administrators see the whole school.
• Every change is recorded. An audit log shows who changed a record, and when.
• Each school is separate. Every school has its own installation; data is never mixed between schools.

Where records are kept

• The application runs on Cloudflare's network.
• Student documents stay in the school's own Google Drive, and only administrators can open them.
• Every night, data is backed up with AES-256 encryption to two places: a private GitHub repository and the school's own Google Drive.

Parents' rights

Under FERPA, parents and eligible students may inspect records and ask for corrections. Those requests go to the school. SchoolWised helps the school find, export and correct the records. Parents do not log in to SchoolWised today; a parent portal is planned.

When a school leaves

The school can export its records at any time. When a school stops using SchoolWised, we delete its records and backups within 30 days, except where the law requires us to keep them, and confirm the deletion to the school in writing.

Security incidents

If we learn of unauthorized access to a school's records, we will notify the school without undue delay so it can meet its own obligations. [Confirm the notification time frame.]

Questions

Schools can ask for a copy of our data agreement or send questions to [email protected]. See also our Privacy Policy.