Part 3 — Student Records in Q

Summary of our commitments

• Aequitas does not share student information with advertisers or marketers, and does not permit advertising within its products
• Aequitas does not own any data tracked within a school district’s system
• Student data is private and owned by each respective LEA
• Aequitas uses industry best practices and high standards to protect data
• Aequitas complies with FERPA, COPPA, HIPAA, California Education Code 49073.1 (formerly AB 1584), and other applicable requirements

Third-party service providers and subprocessors

We work with third-party services to provide, maintain, protect, and improve Aequitas products. We share information with partners, vendors, and trusted organizations to process it on our behalf in accordance with our instructions, this Privacy Policy, and appropriate confidentiality and security requirements. These companies have access only to the information they need to provide the service.

Our significant third-party suppliers, considered subprocessors under applicable data protection laws, are listed below. This list may change over time and Aequitas will keep it updated.

Information shared: contact information, including but not limited to names, emails, and telephone numbers, as determined by your educational agency.

At the direction of your educational agency, Aequitas will also provide access to your data to other third-party service providers. Your educational agency is solely responsible for obtaining information from those third parties regarding their certification and compliance with applicable state and federal student data privacy laws. Aequitas will never disclose your information to a third party without express consent from you or your educational agency.

Data storage locations

FERPA Compliance and Student Data Privacy Policy

Aequitas, in its role as a vendor to educational agencies and institutions (LEAs), receives disclosures from LEAs of personally identifiable information (PII) contained in student records. Only information needed for Aequitas to perform services outsourced to it by the LEA is disclosed to Aequitas. These disclosures are authorized under the Family Educational Rights and Privacy Act (FERPA), a federal statute that regulates the privacy of student records by LEAs that receive financial assistance from the U.S. Department of Education. Aequitas, as a contractor to the LEA, receives the disclosures on the same basis as school officials employed by the LEA, consistent with FERPA regulations, 34 CFR §99.31(a)(1)(i)(B). Consistent with those regulations, Aequitas has a legitimate educational interest in the information to which it is given access because the information is needed to perform the outsourced service, and Aequitas is under the direct control of the LEA in using and maintaining the disclosed education records, consistent with the terms of its contract.

Aequitas is subject to the same conditions on use and redisclosure of education records that govern all school officials, as provided in 34 CFR §99.33. In particular, Aequitas must ensure that only individuals it employs, or who are employed by its contractors, with legitimate educational interests consistent with the purposes for which Aequitas obtained the information, obtain access to PII from education records it maintains on behalf of the district or institution. Further, in accordance with 34 CFR §99.33(a) and (b), Aequitas may not redisclose PII without consent of a parent or an eligible student (meaning a student who is 18 years old or above, or is enrolled in postsecondary education) unless the agency or institution has authorized the redisclosure under a FERPA exception and the agency or institution records the subsequent disclosure. An example of such a disclosure is when Aequitas is requested by a school district to assist in transferring student records from our system to another system.

Aequitas will not sell or otherwise use or redisclose education records for targeted advertising or marketing purposes. Aequitas does not allow advertising within its products, and therefore there is no behavioral or targeted advertising. Aequitas uses data within its products only to deliver the services contracted by the educational institution. Aequitas may use anonymized, non-PII data internally to improve the products and services it delivers to LEAs.

Aequitas employs extensive technological and operational measures to ensure data security and privacy, including advanced security systems technology, physical access controls, annual privacy training for employees and partners, and criminal background checks of all employees. All data is housed within the United States. Details about the audits and company policies which support the Aequitas security programs are available to LEAs under a non-disclosure agreement.

All employees of Aequitas are required to sign an Employee Handbook that commits them to comply with Aequitas’s data privacy and security policies and to receive required annual security and privacy training, including commitments and training regarding the prohibition on disclosure of student data.

Aequitas does not own any of the student data or district-created data within its products. This data is the property of, and under the control of, the local educational agency. The collection, input, use, retention, disposal, and disclosure of any information in our software applications are controlled solely by the LEAs which license our products. Aequitas cannot delete, change, or disclose any information from our software applications controlled by the LEA. Students who wish to retain possession and control of their own pupil-generated content should contact the LEA. If the LEA is unable to fulfill the request of the student, Aequitas can assist at the direction and expense of the LEA.

In the event any third party (including an eligible student or the parent/guardian of an eligible student) seeks to access education records, Aequitas will refer the request to the appropriate LEA. Aequitas shall not provide access to such data or respond to such requests unless compelled to do so by court order or lawfully issued subpoena from a court of competent jurisdiction, or directed to do so by the LEA. Should Aequitas receive a court order or lawfully issued subpoena seeking the release of such data, Aequitas shall provide immediate notification, along with a copy thereof, to the LEA prior to releasing the requested data, unless such notification is prohibited by law or by judicial or administrative order or subpoena.

If the LEA is unable to fulfill a request of an eligible student or parent/guardian to review the student’s records, Aequitas can assist at the direction and expense of the LEA. Where a parent, legal guardian, or eligible student seeks to make changes to data within our products, they shall follow the procedures established by the LEA in accordance with FERPA. Generally, these procedures establish the right to request an amendment of a student’s education records that the parent or eligible student believes is inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA. Parents or eligible students who wish to ask the LEA to amend their child’s or their own education record should write to an LEA official (often a Principal or Superintendent), clearly identify the part of the record they want changed, and specify why it should be changed. If the LEA decides not to amend the record as requested, the LEA will notify the parent or eligible student of the decision and of their right to a hearing regarding the request for amendment. Additional information regarding hearing procedures would be provided when the right to a hearing is communicated.

In the event Aequitas becomes aware of a data breach or inadvertent disclosure of PII, Aequitas shall take immediate steps to limit and mitigate the security breach to the extent possible. A senior executive of Aequitas will notify a senior member of the affected LEA’s leadership team, ideally the Superintendent or similar chief executive. This will typically occur within 24 hours of confirmation of the event and will include the known relevant details. The LEA and Aequitas will work cooperatively to determine an action plan, including any required notification of affected persons. Where Aequitas is at fault for the breach or disclosure, Aequitas carries a cyber-liability insurance policy providing for a number of potential remedies, including credit monitoring for affected parties, fraud coverage, crisis management communications coverage, business interruption coverage, and data restoration coverage.

In the event of termination of a license to use our products, Aequitas works with the LEA, in accordance with the terms of the LEA’s contract, to destroy all student records contained in our systems and then permanently delete all archival or backup copies of the agency’s or institution’s data. Aequitas shall not knowingly retain copies of any data received from the LEA once the LEA has directed Aequitas as to how such information shall be returned or destroyed. Aequitas shall dispose of all data received from the LEA in a commercially reasonable manner that maintains the confidentiality of the contents of such records (for example, shredding paper records, erasing and reformatting hard drives, and erasing or physically destroying portable electronic devices). At the request of the LEA, Aequitas will provide written certification of destruction.

To the extent parents, guardians, or students have questions regarding the content of, or privacy associated with, any applications used by an educational institution, please contact that agency or institution.

Aequitas may from time to time update this policy to follow evolving state and federal laws and regulations. We will not materially change our policies and practices to make them less protective of your privacy without the written consent of the LEA, and the LEA may rely upon and enforce any current or prior version of this policy unless otherwise agreed in writing.

Data collected by our LEAs through the use of Q is not the property of Aequitas, nor does Aequitas use this data. Examples of data that may be collected by your child’s school or district include:

1. Class attendance, class behavior, student enrollment, testing scores, transcripts, student schedule and assignments, GPA, and similar records
2. Health information such as immunization and medical history
3. Birth information, gender, language information, address information, and telephone number
4. Interactions with teachers and staff through features available in the mobile app

California AB 1584

Regarding FERPA and California AB 1584 (Buchanan), Privacy of Pupil Records: 3rd-Party Digital Storage & Education Software (Education Code section 49073.1), Aequitas abides by the following:

Student records obtained by Aequitas from an educational institution continue to be the property of and under the control of the educational institution. The educational institution retains full ownership rights to the personal information and education records it provides to Aequitas.

Aequitas users may retain possession and control of their own generated content by contacting Aequitas at info@myaequitas.com.

Aequitas will not use any information in a student record for any purpose other than those required or specifically permitted by the Aequitas Terms of Service and Privacy Policy.

Parents, legal guardians, or eligible students may review personally identifiable information in a student’s records and correct erroneous information by contacting their educational institution. Additionally, Aequitas users may access, correct, update, or delete personal information in their profile by signing into their account, accessing their parent or student account, and making the appropriate changes.

Aequitas is committed to maintaining the security and confidentiality of student records. To that end: (a) we limit employee access to student data to only those employees who need such access to fulfill their job responsibilities; (b) we conduct background checks on employees who may have access to student data; (c) we conduct regular employee privacy and data security training and education; and (d) we protect personal information with technical, contractual, administrative, and physical security safeguards to protect against unauthorized access, release, or use.

In the event of an unauthorized disclosure of a student’s records, Aequitas will promptly notify users unless specifically directed not to do so by law enforcement officials. Notification shall identify: (i) the date and nature of the unauthorized use or disclosure; (ii) the private data used or disclosed; (iii) a general description of what occurred, including who made the unauthorized use or received the unauthorized disclosure; (iv) what Aequitas has done or shall do to mitigate any effect of the unauthorized use or disclosure; (v) what corrective action Aequitas has taken or shall take to prevent future similar unauthorized use or disclosure; and (vi) whom at Aequitas the user can contact. Aequitas will keep the user fully informed until the incident is resolved.

Aequitas will delete or de-identify personal information when it is no longer needed, upon expiration or termination of our agreement with an educational institution, with any deletion or de-identification completed according to the terms of our agreement with the educational institution, or at the direction or request of the educational institution.

Aequitas agrees to work with educational institutions to ensure compliance with FERPA, and the parties will ensure compliance by providing parents, legal guardians, or eligible students with the ability to inspect and review student records and to correct any inaccuracies therein as described above.

Aequitas prohibits using personally identifiable information in student records to engage in targeted advertising.

COPPA Compliance

The Children’s Online Privacy Protection Act (COPPA) does not apply to Aequitas. Aequitas products do not collect personally identifiable information (PII) from children under the age of 13. PII collected and maintained within Aequitas products is entered by adults — either the child’s parent or guardian during an enrollment process, or by school officials who use our products to operate the school. Access to the system is granted to all users by the educational agencies and institutions (LEAs) which license our products.

The collection, input, use, retention, disposal, and disclosure of any private information in our software applications is controlled solely by the LEAs which license our products. Aequitas cannot delete, change, or disclose any information from our software applications controlled by the LEA. To the extent parents, guardians, or students have questions regarding privacy associated with applications provided by the LEA, please contact that agency or institution.

HIPAA Compliance

Student records disclosed to Aequitas by LEAs and maintained within Aequitas products are by definition “education records” under FERPA and not “protected health information” under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Because student health information in education records is protected by FERPA, the HIPAA Privacy Rule excludes such information from its coverage. See the exception at paragraph (2)(i) to the definition of “protected health information” in the HIPAA Privacy Rule at 45 CFR § 160.103. See also Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to Student Health Records, U.S. Department of Education and U.S. Department of Health and Human Services (November 2008).

Contact

For further information regarding this privacy policy or related Aequitas policies and procedures, contact us at info@myaequitas.com or:

ATTN: Privacy Office Aequitas Solutions, Inc. 7365 Carnelian Street, Suite 208 Rancho Cucamonga, CA 91730