SMARTIS Pro Privacy Policy

SMARTIS Pro operates as a "school official" with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)) when providing services to educational institutions. This means:

• We collect and process student education records only at the direction of, and on behalf of, the school or district that contracts with us.
• The school or district retains ownership and control of all student education records at all times.
• We remain under the direct control of the school with respect to the use and maintenance of education records.
• We use personally identifiable information (PII) from education records only for the purposes for which it was disclosed — namely, providing the Service.
• We do not re-disclose PII from education records to third parties except as directed by the school, as permitted by FERPA, or as required by law.
• We do not use student education records for targeted advertising, marketing, or building profiles for non-educational purposes. Ever.

Parents and eligible students (age 18+) who wish to inspect, review, or amend education records should contact their school or district directly, as the school controls those records. We will support schools in fulfilling these requests.

Student Information Entered by School Staff

Authorized school staff enter and maintain student information in the Service, which may include:

• Demographic information: student name, date of birth, grade level, student ID, gender, race/ethnicity, and enrollment details
• Attendance records: daily attendance, absences, and tardiness
• Assessment and progress data: academic assessments, scores, and progress monitoring records
• Meeting records: notes and documentation from student-related meetings (e.g., team meetings, parent conferences, IEP or support planning meetings)
• Clinical and support needs: health, behavioral, counseling, or other clinical information relevant to the student's educational program and services
• Parent/guardian names and contact information

A note on clinical information: Health and clinical records maintained by or for a school as part of a student's education record are protected under FERPA (and are generally excluded from HIPAA when held as education records). We treat this information as highly sensitive and apply heightened access controls as described in Section 6.

Staff Account Information

We collect information from staff users needed to create and manage accounts, such as name, work email address, role, and login credentials.

Information Collected Automatically

When staff users access the Service, we DO NOT automatically collect:

• Device type, operating system, and app version
• Log data (login timestamps, feature usage, error reports)
• IP address

We do not collect precise geolocation data.

Information We Do NOT Collect

• We do not collect information from students for advertising purposes.
• We do not use cookies or tracking technologies for cross-app or cross-site behavioral advertising.
• We do not sell personal information — of students, staff, or anyone else — under any circumstances.

SMARTIS Pro is not directed to children, and students do not use or interact with the Service. The Service does not collect personal information directly from any child under 13; accordingly, the Children's Online Privacy Protection Act's (COPPA) requirements regarding direct online collection from children do not apply to the Service's operation.

Student information stored in the Service is entered by authorized school staff and is protected as an education record under FERPA and applicable state student privacy laws, as described throughout this policy. We never use student information for marketing, advertising, or profiling, and parents may exercise their rights regarding their child's records through their school as described in Section 8.

We use the information described above solely to:

• Provide, maintain, and improve the Service for the contracting school or district
• Manage user accounts and authenticate users
• Generate reports, records, and analytics for the school's educational purposes
• Provide technical support and respond to service requests
• Maintain the security and integrity of the Service
• Comply with legal obligations

We may use de-identified, aggregated data (data that cannot reasonably be used to identify any individual student) to improve and develop the Service, as permitted by law and our agreements with schools.

We do not sell, rent, or trade personal information. We share information only:

• With the contracting school or district and its authorized users (administrators, teachers, and staff with appropriate permissions)
• With service providers that help us operate the Service (e.g., cloud hosting), who are contractually bound to protect the information, use it only to provide services to us, and comply with FERPA-consistent obligations — MongoDB for our Database, and Emergent is the Building Platform.
• As required by law, such as in response to a lawful subpoena or court order, in which case we will notify the school unless legally prohibited
• In a business transfer (merger, acquisition), in which case student data will remain subject to this policy and our school agreements, and schools will be notified with the opportunity to delete their data

We take the security of student data seriously and use administrative, technical, and physical safeguards designed to protect it, including:

• Encryption of data in transit (TLS) and at rest provided by Emergent
• Role-based access controls: staff members can access only the student information appropriate to their role and legitimate educational interest, as configured by the school. Sensitive categories such as clinical and support information can be restricted to designated staff.
• Secure authentication practices for all staff accounts
• Audit logging of access to student records
• Regular security reviews are performed by the Admin listed for the school's users. A push notification is on all Admin dashboards each Friday. If an Admin does not review the audit log within 72 hours of the prompt their users will be locked until it is marked as reviewed.

In the event of a data breach involving student PII, we will notify affected schools promptly and without unreasonable delay, and will cooperate with schools in meeting their notification obligations under applicable law.

• We retain student education records only for as long as necessary to provide the Service to the school, or as directed by the school.
• Upon termination of our agreement with a school, or upon the school's request, we will delete or return student education records within 60 days, except where retention is required by law.
• Schools may request deletion of specific student records at any time by contacting us at admin@smartispro.com

Parents and eligible students: Rights to access, review, and request amendment of education records run through your school or district under FERPA. Contact your school directly; we will support these requests.

School administrators: You may access, correct, export, or delete data through the Service or by contacting us via email at admin@smartispro.com

Currently we do not use any third-party integrations.

We may update this Privacy Policy from time to time. If we make material changes affecting the collection or use of student personal information, we will notify contracting schools in advance and obtain any consent required by law before the changes take effect. The "Last Updated" date at the top reflects the most recent revision.

If you have questions about this Privacy Policy or our data practices: